<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/net, branch v3.17-rc2</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>mac80211: fix channel switch for chanctx-based drivers</title>
<updated>2014-08-22T21:45:49+00:00</updated>
<author>
<name>Michal Kazior</name>
<email>michal.kazior@tieto.com</email>
</author>
<published>2014-08-18T11:19:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=47e4df94d129cbca84de252ff63c4ded08a513e7'/>
<id>47e4df94d129cbca84de252ff63c4ded08a513e7</id>
<content type='text'>
The new_ctx pointer is set only for non-chanctx drivers.  This yielded a
crash for chanctx-based drivers during channel switch finalization:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  IP: ieee80211_vif_use_reserved_switch+0x71c/0xb00 [mac80211]

Use an adequate chanctx pointer to fix this.

Reported-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Michal Kazior &lt;michal.kazior@tieto.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The new_ctx pointer is set only for non-chanctx drivers.  This yielded a
crash for chanctx-based drivers during channel switch finalization:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  IP: ieee80211_vif_use_reserved_switch+0x71c/0xb00 [mac80211]

Use an adequate chanctx pointer to fix this.

Reported-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Michal Kazior &lt;michal.kazior@tieto.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: sctp: fix suboptimal edge-case on non-active active/retrans path selection</title>
<updated>2014-08-22T18:31:30+00:00</updated>
<author>
<name>Daniel Borkmann</name>
<email>dborkman@redhat.com</email>
</author>
<published>2014-08-22T11:03:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=aa4a83ee8bbc08342c4acfd59ef234cac51a1eef'/>
<id>aa4a83ee8bbc08342c4acfd59ef234cac51a1eef</id>
<content type='text'>
In SCTP, selection of active (T.ACT) and retransmission (T.RET)
transports is being done whenever transport control operations
(UP, DOWN, PF, ...) are engaged through sctp_assoc_control_transport().

Commits 4c47af4d5eb2 ("net: sctp: rework multihoming retransmission
path selection to rfc4960") and a7288c4dd509 ("net: sctp: improve
sctp_select_active_and_retran_path selection") have both improved
it towards a more fine-grained and optimal path selection.

Currently, the selection algorithm for T.ACT and T.RET is as follows:

1) Elect the two most recently used ACTIVE transports T1, T2 for
   T.ACT, T.RET, where T.ACT&lt;-T1 and T1 is most recently used
2) In case primary path T.PRI not in {T1, T2} but ACTIVE, set
   T.ACT&lt;-T.PRI and T.RET&lt;-T1
3) If only T1 is ACTIVE from the set, set T.ACT&lt;-T1 and T.RET&lt;-T1
4) If none is ACTIVE, set T.ACT&lt;-best(T.PRI, T.RET, T3) where
   T3 is the most recently used (if avail) in PF, set T.RET&lt;-T.PRI

Prior to above commits, 4) was simply a camp on T.ACT&lt;-T.PRI and
T.RET&lt;-T.PRI, ignoring possible paths in PF. Camping on T.PRI is
still slightly suboptimal as it can lead to the following scenario:

Setup:
        &lt;A&gt;                                &lt;B&gt;
    T1: p1p1 (10.0.10.10) &lt;==&gt;  .'`)  &lt;==&gt; p1p1 (10.0.10.12)  &lt;= T.PRI
    T2: p1p2 (10.0.10.20) &lt;==&gt; (_ . ) &lt;==&gt; p1p2 (10.0.10.22)

    net.sctp.rto_min = 1000
    net.sctp.path_max_retrans = 2
    net.sctp.pf_retrans = 0
    net.sctp.hb_interval = 1000

T.PRI is permanently down, T2 is put briefly into PF state (e.g. due to
link flapping). Here, the first time transmission is sent over PF path
T2 as it's the only non-INACTIVE path, but the retransmitted data-chunks
are sent over the INACTIVE path T1 (T.PRI), which is not good.

After the patch, it's choosing better transports in both cases by
modifying step 4):

4) If none is ACTIVE, set T.ACT_new&lt;-best(T.ACT_old, T3) where T3 is
   the most recently used (if avail) in PF, set T.RET&lt;-T.ACT_new

This will still select a best possible path in PF if available (which
can also include T.PRI/T.RET), and set both T.ACT/T.RET to it.

In case sctp_assoc_control_transport() *just* put T.ACT_old into INACTIVE
as it transitioned from ACTIVE-&gt;PF-&gt;INACTIVE and stays in INACTIVE just
for a very short while before going back ACTIVE, it will guarantee that
this path will be reselected for T.ACT/T.RET since T3 (PF) is not
available.

Previously, this was not possible, as we would only select between T.PRI
and T.RET, and a possible T3 would be NULL due to the fact that we have
just transitioned T3 in sctp_assoc_control_transport() from PF-&gt;INACTIVE
and would select a suboptimal path when T.PRI/T.RET have worse properties.

In the case that T.ACT_old permanently went to INACTIVE during this
transition and there's no PF path available, plus T.PRI and T.RET are
INACTIVE as well, we would now camp on T.ACT_old, but if everything is
being INACTIVE there's really not much we can do except hoping for a
successful HB to bring one of the transports back up again and, thus
cause a new selection through sctp_assoc_control_transport().

Now both tests work fine:

Case 1:

 1. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

 2. T1 S(ACTIVE) T.ACT, T.RET
    T2 S(PF)

 3. T1 S(ACTIVE) T.ACT, T.RET
    T2 S(INACTIVE)

 5. T1 S(PF) T.ACT, T.RET
    T2 S(INACTIVE)

[ 5.1 T1 S(INACTIVE) T.ACT, T.RET
      T2 S(INACTIVE) ]

 6. T1 S(ACTIVE) T.ACT, T.RET
    T2 S(INACTIVE)

 7. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

Case 2:

 1. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

 2. T1 S(PF)
    T2 S(ACTIVE) T.ACT, T.RET

 3. T1 S(INACTIVE)
    T2 S(ACTIVE) T.ACT, T.RET

 5. T1 S(INACTIVE)
    T2 S(PF) T.ACT, T.RET

[ 5.1 T1 S(INACTIVE)
      T2 S(INACTIVE) T.ACT, T.RET ]

 6. T1 S(INACTIVE)
    T2 S(ACTIVE) T.ACT, T.RET

 7. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

Signed-off-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Acked-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In SCTP, selection of active (T.ACT) and retransmission (T.RET)
transports is being done whenever transport control operations
(UP, DOWN, PF, ...) are engaged through sctp_assoc_control_transport().

Commits 4c47af4d5eb2 ("net: sctp: rework multihoming retransmission
path selection to rfc4960") and a7288c4dd509 ("net: sctp: improve
sctp_select_active_and_retran_path selection") have both improved
it towards a more fine-grained and optimal path selection.

Currently, the selection algorithm for T.ACT and T.RET is as follows:

1) Elect the two most recently used ACTIVE transports T1, T2 for
   T.ACT, T.RET, where T.ACT&lt;-T1 and T1 is most recently used
2) In case primary path T.PRI not in {T1, T2} but ACTIVE, set
   T.ACT&lt;-T.PRI and T.RET&lt;-T1
3) If only T1 is ACTIVE from the set, set T.ACT&lt;-T1 and T.RET&lt;-T1
4) If none is ACTIVE, set T.ACT&lt;-best(T.PRI, T.RET, T3) where
   T3 is the most recently used (if avail) in PF, set T.RET&lt;-T.PRI

Prior to above commits, 4) was simply a camp on T.ACT&lt;-T.PRI and
T.RET&lt;-T.PRI, ignoring possible paths in PF. Camping on T.PRI is
still slightly suboptimal as it can lead to the following scenario:

Setup:
        &lt;A&gt;                                &lt;B&gt;
    T1: p1p1 (10.0.10.10) &lt;==&gt;  .'`)  &lt;==&gt; p1p1 (10.0.10.12)  &lt;= T.PRI
    T2: p1p2 (10.0.10.20) &lt;==&gt; (_ . ) &lt;==&gt; p1p2 (10.0.10.22)

    net.sctp.rto_min = 1000
    net.sctp.path_max_retrans = 2
    net.sctp.pf_retrans = 0
    net.sctp.hb_interval = 1000

T.PRI is permanently down, T2 is put briefly into PF state (e.g. due to
link flapping). Here, the first time transmission is sent over PF path
T2 as it's the only non-INACTIVE path, but the retransmitted data-chunks
are sent over the INACTIVE path T1 (T.PRI), which is not good.

After the patch, it's choosing better transports in both cases by
modifying step 4):

4) If none is ACTIVE, set T.ACT_new&lt;-best(T.ACT_old, T3) where T3 is
   the most recently used (if avail) in PF, set T.RET&lt;-T.ACT_new

This will still select a best possible path in PF if available (which
can also include T.PRI/T.RET), and set both T.ACT/T.RET to it.

In case sctp_assoc_control_transport() *just* put T.ACT_old into INACTIVE
as it transitioned from ACTIVE-&gt;PF-&gt;INACTIVE and stays in INACTIVE just
for a very short while before going back ACTIVE, it will guarantee that
this path will be reselected for T.ACT/T.RET since T3 (PF) is not
available.

Previously, this was not possible, as we would only select between T.PRI
and T.RET, and a possible T3 would be NULL due to the fact that we have
just transitioned T3 in sctp_assoc_control_transport() from PF-&gt;INACTIVE
and would select a suboptimal path when T.PRI/T.RET have worse properties.

In the case that T.ACT_old permanently went to INACTIVE during this
transition and there's no PF path available, plus T.PRI and T.RET are
INACTIVE as well, we would now camp on T.ACT_old, but if everything is
being INACTIVE there's really not much we can do except hoping for a
successful HB to bring one of the transports back up again and, thus
cause a new selection through sctp_assoc_control_transport().

Now both tests work fine:

Case 1:

 1. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

 2. T1 S(ACTIVE) T.ACT, T.RET
    T2 S(PF)

 3. T1 S(ACTIVE) T.ACT, T.RET
    T2 S(INACTIVE)

 5. T1 S(PF) T.ACT, T.RET
    T2 S(INACTIVE)

[ 5.1 T1 S(INACTIVE) T.ACT, T.RET
      T2 S(INACTIVE) ]

 6. T1 S(ACTIVE) T.ACT, T.RET
    T2 S(INACTIVE)

 7. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

Case 2:

 1. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

 2. T1 S(PF)
    T2 S(ACTIVE) T.ACT, T.RET

 3. T1 S(INACTIVE)
    T2 S(ACTIVE) T.ACT, T.RET

 5. T1 S(INACTIVE)
    T2 S(PF) T.ACT, T.RET

[ 5.1 T1 S(INACTIVE)
      T2 S(INACTIVE) T.ACT, T.RET ]

 6. T1 S(INACTIVE)
    T2 S(ACTIVE) T.ACT, T.RET

 7. T1 S(ACTIVE) T.ACT
    T2 S(ACTIVE) T.RET

Signed-off-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Acked-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: sctp: spare unnecessary comparison in sctp_trans_elect_best</title>
<updated>2014-08-22T18:31:30+00:00</updated>
<author>
<name>Daniel Borkmann</name>
<email>dborkman@redhat.com</email>
</author>
<published>2014-08-22T11:03:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ea4f19c1f81d4bf709c74e3789ec785828bc6e51'/>
<id>ea4f19c1f81d4bf709c74e3789ec785828bc6e51</id>
<content type='text'>
When both transports are the same, we don't have to go down that
road only to realize that we will return the very same transport.
We are guaranteed that curr is always non-NULL. Therefore, just
short-circuit this special case.

Signed-off-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Acked-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When both transports are the same, we don't have to go down that
road only to realize that we will return the very same transport.
We are guaranteed that curr is always non-NULL. Therefore, just
short-circuit this special case.

Signed-off-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Acked-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>openvswitch: fix panic with multiple vlan headers</title>
<updated>2014-08-22T18:24:04+00:00</updated>
<author>
<name>Jiri Benc</name>
<email>jbenc@redhat.com</email>
</author>
<published>2014-08-21T19:33:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2ba5af42a7b59ef01f9081234d8855140738defd'/>
<id>2ba5af42a7b59ef01f9081234d8855140738defd</id>
<content type='text'>
When there are multiple vlan headers present in a received frame, the first
one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the
skb beyond the VLAN TPID may be still non-linear, including the inner TCI
and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it
does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is
executed, __pop_vlan_tci pulls the next vlan header into vlan_tci.

This leads to two things:

1. Part of the resulting ethernet header is in the non-linear part of the
   skb. When eth_type_trans is called later as the result of
   OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci
   is in fact accessing random data when it reads past the TPID.

2. network_header points into the ethernet header instead of behind it.
   mac_len is set to a wrong value (10), too.

Reported-by: Yulong Pei &lt;ypei@redhat.com&gt;
Signed-off-by: Jiri Benc &lt;jbenc@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When there are multiple vlan headers present in a received frame, the first
one is put into vlan_tci and protocol is set to ETH_P_8021Q. Anything in the
skb beyond the VLAN TPID may be still non-linear, including the inner TCI
and ethertype. While ovs_flow_extract takes care of IP and IPv6 headers, it
does nothing with ETH_P_8021Q. Later, if OVS_ACTION_ATTR_POP_VLAN is
executed, __pop_vlan_tci pulls the next vlan header into vlan_tci.

This leads to two things:

1. Part of the resulting ethernet header is in the non-linear part of the
   skb. When eth_type_trans is called later as the result of
   OVS_ACTION_ATTR_OUTPUT, kernel BUGs in __skb_pull. Also, __pop_vlan_tci
   is in fact accessing random data when it reads past the TPID.

2. network_header points into the ethernet header instead of behind it.
   mac_len is set to a wrong value (10), too.

Reported-by: Yulong Pei &lt;ypei@redhat.com&gt;
Signed-off-by: Jiri Benc &lt;jbenc@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: ipv6: fib: don't sleep inside atomic lock</title>
<updated>2014-08-22T17:54:49+00:00</updated>
<author>
<name>Benjamin Block</name>
<email>bebl@mageta.org</email>
</author>
<published>2014-08-21T17:37:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=793c3b4000a1ef611ae7e5c89bd2a9c6b776cb5e'/>
<id>793c3b4000a1ef611ae7e5c89bd2a9c6b776cb5e</id>
<content type='text'>
The function fib6_commit_metrics() allocates a piece of memory in mode
GFP_KERNEL while holding an atomic lock from higher up in the stack, in
the function __ip6_ins_rt(). This produces the following BUG:

&gt; BUG: sleeping function called from invalid context at mm/slub.c:1250
&gt; in_atomic(): 1, irqs_disabled(): 0, pid: 2909, name: dhcpcd
&gt; 2 locks held by dhcpcd/2909:
&gt;  #0:  (rtnl_mutex){+.+.+.}, at: [&lt;ffffffff81978e67&gt;] rtnl_lock+0x17/0x20
&gt;  #1:  (&amp;tb-&gt;tb6_lock){++--+.}, at: [&lt;ffffffff81a6951a&gt;] ip6_route_add+0x65a/0x800
&gt; CPU: 1 PID: 2909 Comm: dhcpcd Not tainted 3.17.0-rc1 #1
&gt; Hardware name: ASUS All Series/Q87T, BIOS 0216 10/16/2013
&gt;  0000000000000008 ffff8800c8f13858 ffffffff81af135a 0000000000000000
&gt;  ffff880212202430 ffff8800c8f13878 ffffffff810f8d3a ffff880212202c98
&gt;  0000000000000010 ffff8800c8f138c8 ffffffff8121ad0e 0000000000000001
&gt; Call Trace:
&gt;  [&lt;ffffffff81af135a&gt;] dump_stack+0x4e/0x68
&gt;  [&lt;ffffffff810f8d3a&gt;] __might_sleep+0x10a/0x120
&gt;  [&lt;ffffffff8121ad0e&gt;] kmem_cache_alloc_trace+0x4e/0x190
&gt;  [&lt;ffffffff81a6bcd6&gt;] ? fib6_commit_metrics+0x66/0x110
&gt;  [&lt;ffffffff81a6bcd6&gt;] fib6_commit_metrics+0x66/0x110
&gt;  [&lt;ffffffff81a6cbf3&gt;] fib6_add+0x883/0xa80
&gt;  [&lt;ffffffff81a6951a&gt;] ? ip6_route_add+0x65a/0x800
&gt;  [&lt;ffffffff81a69535&gt;] ip6_route_add+0x675/0x800
&gt;  [&lt;ffffffff81a68f2a&gt;] ? ip6_route_add+0x6a/0x800
&gt;  [&lt;ffffffff81a6990c&gt;] inet6_rtm_newroute+0x5c/0x80
&gt;  [&lt;ffffffff8197cf01&gt;] rtnetlink_rcv_msg+0x211/0x260
&gt;  [&lt;ffffffff81978e67&gt;] ? rtnl_lock+0x17/0x20
&gt;  [&lt;ffffffff81119708&gt;] ? lock_release_holdtime+0x28/0x180
&gt;  [&lt;ffffffff81978e67&gt;] ? rtnl_lock+0x17/0x20
&gt;  [&lt;ffffffff8197ccf0&gt;] ? __rtnl_unlock+0x20/0x20
&gt;  [&lt;ffffffff819a989e&gt;] netlink_rcv_skb+0x6e/0xd0
&gt;  [&lt;ffffffff81978ee5&gt;] rtnetlink_rcv+0x25/0x40
&gt;  [&lt;ffffffff819a8e59&gt;] netlink_unicast+0xd9/0x180
&gt;  [&lt;ffffffff819a9600&gt;] netlink_sendmsg+0x700/0x770
&gt;  [&lt;ffffffff81103735&gt;] ? local_clock+0x25/0x30
&gt;  [&lt;ffffffff8194e83c&gt;] sock_sendmsg+0x6c/0x90
&gt;  [&lt;ffffffff811f98e3&gt;] ? might_fault+0xa3/0xb0
&gt;  [&lt;ffffffff8195ca6d&gt;] ? verify_iovec+0x7d/0xf0
&gt;  [&lt;ffffffff8194ec3e&gt;] ___sys_sendmsg+0x37e/0x3b0
&gt;  [&lt;ffffffff8111ef15&gt;] ? trace_hardirqs_on_caller+0x185/0x220
&gt;  [&lt;ffffffff81af979e&gt;] ? mutex_unlock+0xe/0x10
&gt;  [&lt;ffffffff819a55ec&gt;] ? netlink_insert+0xbc/0xe0
&gt;  [&lt;ffffffff819a65e5&gt;] ? netlink_autobind.isra.30+0x125/0x150
&gt;  [&lt;ffffffff819a6520&gt;] ? netlink_autobind.isra.30+0x60/0x150
&gt;  [&lt;ffffffff819a84f9&gt;] ? netlink_bind+0x159/0x230
&gt;  [&lt;ffffffff811f989a&gt;] ? might_fault+0x5a/0xb0
&gt;  [&lt;ffffffff8194f25e&gt;] ? SYSC_bind+0x7e/0xd0
&gt;  [&lt;ffffffff8194f8cd&gt;] __sys_sendmsg+0x4d/0x80
&gt;  [&lt;ffffffff8194f912&gt;] SyS_sendmsg+0x12/0x20
&gt;  [&lt;ffffffff81afc692&gt;] system_call_fastpath+0x16/0x1b

Fixing this by replacing the mode GFP_KERNEL with GFP_ATOMIC.

Signed-off-by: Benjamin Block &lt;bebl@mageta.org&gt;
Acked-by: David Rientjes &lt;rientjes@google.com&gt;
Acked-by: Hannes Frederic Sowa &lt;hannes@stressinduktion.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The function fib6_commit_metrics() allocates a piece of memory in mode
GFP_KERNEL while holding an atomic lock from higher up in the stack, in
the function __ip6_ins_rt(). This produces the following BUG:

&gt; BUG: sleeping function called from invalid context at mm/slub.c:1250
&gt; in_atomic(): 1, irqs_disabled(): 0, pid: 2909, name: dhcpcd
&gt; 2 locks held by dhcpcd/2909:
&gt;  #0:  (rtnl_mutex){+.+.+.}, at: [&lt;ffffffff81978e67&gt;] rtnl_lock+0x17/0x20
&gt;  #1:  (&amp;tb-&gt;tb6_lock){++--+.}, at: [&lt;ffffffff81a6951a&gt;] ip6_route_add+0x65a/0x800
&gt; CPU: 1 PID: 2909 Comm: dhcpcd Not tainted 3.17.0-rc1 #1
&gt; Hardware name: ASUS All Series/Q87T, BIOS 0216 10/16/2013
&gt;  0000000000000008 ffff8800c8f13858 ffffffff81af135a 0000000000000000
&gt;  ffff880212202430 ffff8800c8f13878 ffffffff810f8d3a ffff880212202c98
&gt;  0000000000000010 ffff8800c8f138c8 ffffffff8121ad0e 0000000000000001
&gt; Call Trace:
&gt;  [&lt;ffffffff81af135a&gt;] dump_stack+0x4e/0x68
&gt;  [&lt;ffffffff810f8d3a&gt;] __might_sleep+0x10a/0x120
&gt;  [&lt;ffffffff8121ad0e&gt;] kmem_cache_alloc_trace+0x4e/0x190
&gt;  [&lt;ffffffff81a6bcd6&gt;] ? fib6_commit_metrics+0x66/0x110
&gt;  [&lt;ffffffff81a6bcd6&gt;] fib6_commit_metrics+0x66/0x110
&gt;  [&lt;ffffffff81a6cbf3&gt;] fib6_add+0x883/0xa80
&gt;  [&lt;ffffffff81a6951a&gt;] ? ip6_route_add+0x65a/0x800
&gt;  [&lt;ffffffff81a69535&gt;] ip6_route_add+0x675/0x800
&gt;  [&lt;ffffffff81a68f2a&gt;] ? ip6_route_add+0x6a/0x800
&gt;  [&lt;ffffffff81a6990c&gt;] inet6_rtm_newroute+0x5c/0x80
&gt;  [&lt;ffffffff8197cf01&gt;] rtnetlink_rcv_msg+0x211/0x260
&gt;  [&lt;ffffffff81978e67&gt;] ? rtnl_lock+0x17/0x20
&gt;  [&lt;ffffffff81119708&gt;] ? lock_release_holdtime+0x28/0x180
&gt;  [&lt;ffffffff81978e67&gt;] ? rtnl_lock+0x17/0x20
&gt;  [&lt;ffffffff8197ccf0&gt;] ? __rtnl_unlock+0x20/0x20
&gt;  [&lt;ffffffff819a989e&gt;] netlink_rcv_skb+0x6e/0xd0
&gt;  [&lt;ffffffff81978ee5&gt;] rtnetlink_rcv+0x25/0x40
&gt;  [&lt;ffffffff819a8e59&gt;] netlink_unicast+0xd9/0x180
&gt;  [&lt;ffffffff819a9600&gt;] netlink_sendmsg+0x700/0x770
&gt;  [&lt;ffffffff81103735&gt;] ? local_clock+0x25/0x30
&gt;  [&lt;ffffffff8194e83c&gt;] sock_sendmsg+0x6c/0x90
&gt;  [&lt;ffffffff811f98e3&gt;] ? might_fault+0xa3/0xb0
&gt;  [&lt;ffffffff8195ca6d&gt;] ? verify_iovec+0x7d/0xf0
&gt;  [&lt;ffffffff8194ec3e&gt;] ___sys_sendmsg+0x37e/0x3b0
&gt;  [&lt;ffffffff8111ef15&gt;] ? trace_hardirqs_on_caller+0x185/0x220
&gt;  [&lt;ffffffff81af979e&gt;] ? mutex_unlock+0xe/0x10
&gt;  [&lt;ffffffff819a55ec&gt;] ? netlink_insert+0xbc/0xe0
&gt;  [&lt;ffffffff819a65e5&gt;] ? netlink_autobind.isra.30+0x125/0x150
&gt;  [&lt;ffffffff819a6520&gt;] ? netlink_autobind.isra.30+0x60/0x150
&gt;  [&lt;ffffffff819a84f9&gt;] ? netlink_bind+0x159/0x230
&gt;  [&lt;ffffffff811f989a&gt;] ? might_fault+0x5a/0xb0
&gt;  [&lt;ffffffff8194f25e&gt;] ? SYSC_bind+0x7e/0xd0
&gt;  [&lt;ffffffff8194f8cd&gt;] __sys_sendmsg+0x4d/0x80
&gt;  [&lt;ffffffff8194f912&gt;] SyS_sendmsg+0x12/0x20
&gt;  [&lt;ffffffff81afc692&gt;] system_call_fastpath+0x16/0x1b

Fixing this by replacing the mode GFP_KERNEL with GFP_ATOMIC.

Signed-off-by: Benjamin Block &lt;bebl@mageta.org&gt;
Acked-by: David Rientjes &lt;rientjes@google.com&gt;
Acked-by: Hannes Frederic Sowa &lt;hannes@stressinduktion.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>sctp: not send SCTP_PEER_ADDR_CHANGE notifications with failed probe</title>
<updated>2014-08-22T04:33:17+00:00</updated>
<author>
<name>zhuyj</name>
<email>zyjzyj2000@gmail.com</email>
</author>
<published>2014-08-20T09:31:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=061079ac0b9be7a578dcd09f7865c2c0d6ac894a'/>
<id>061079ac0b9be7a578dcd09f7865c2c0d6ac894a</id>
<content type='text'>
Since the transport has always been in state SCTP_UNCONFIRMED, it
therefore wasn't active before and hasn't been used before, and it
always has been, so it is unnecessary to bug the user with a
notification.

Reported-by: Deepak Khandelwal &lt;khandelwal.deepak.1987@gmail.com&gt;
Suggested-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Suggested-by: Michael Tuexen &lt;tuexen@fh-muenster.de&gt;
Suggested-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Signed-off-by: Zhu Yanjun &lt;Yanjun.Zhu@windriver.com&gt;
Acked-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Acked-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Since the transport has always been in state SCTP_UNCONFIRMED, it
therefore wasn't active before and hasn't been used before, and it
always has been, so it is unnecessary to bug the user with a
notification.

Reported-by: Deepak Khandelwal &lt;khandelwal.deepak.1987@gmail.com&gt;
Suggested-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Suggested-by: Michael Tuexen &lt;tuexen@fh-muenster.de&gt;
Suggested-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Signed-off-by: Zhu Yanjun &lt;Yanjun.Zhu@windriver.com&gt;
Acked-by: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Acked-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>packet: handle too big packets for PACKET_V3</title>
<updated>2014-08-21T23:44:28+00:00</updated>
<author>
<name>Eric Dumazet</name>
<email>edumazet@google.com</email>
</author>
<published>2014-08-15T16:16:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=dc808110bb62b64a448696ecac3938902c92e1ab'/>
<id>dc808110bb62b64a448696ecac3938902c92e1ab</id>
<content type='text'>
af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.

This is not generally the case, even if most existing tools do it right.

This patch clamps too long frames as API permits, and issue a one time
error on syslog.

[  394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82

In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb-&gt;len)

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.

This is not generally the case, even if most existing tools do it right.

This patch clamps too long frames as API permits, and issue a one time
error on syslog.

[  394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82

In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb-&gt;len)

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann &lt;dborkman@redhat.com&gt;
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>lec: Use rtnl lock/unlock when updating MTU</title>
<updated>2014-08-21T23:31:23+00:00</updated>
<author>
<name>chas williams - CONTRACTOR</name>
<email>chas@cmf.nrl.navy.mil</email>
</author>
<published>2014-08-14T13:19:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6df378d2d1f87a249a88ac4a8c7a14861d9c9474'/>
<id>6df378d2d1f87a249a88ac4a8c7a14861d9c9474</id>
<content type='text'>
The LECS response contains the MTU that should be used.  Correctly
synchronize with other layers when updating.

Signed-off-by: Chas Williams - CONTRACTOR &lt;chas@cmf.nrl.navy.mil&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The LECS response contains the MTU that should be used.  Correctly
synchronize with other layers when updating.

Signed-off-by: Chas Williams - CONTRACTOR &lt;chas@cmf.nrl.navy.mil&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tipc: Fix build.</title>
<updated>2014-08-19T18:16:38+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2014-08-19T18:14:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=02784f1b05b8f241c8180af88869e717e2758593'/>
<id>02784f1b05b8f241c8180af88869e717e2758593</id>
<content type='text'>
Missing semicolon in range check fix.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Missing semicolon in range check fix.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cbq: now_rt removal</title>
<updated>2014-08-19T17:58:44+00:00</updated>
<author>
<name>Vasily Averin</name>
<email>vvs@parallels.com</email>
</author>
<published>2014-08-14T08:27:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7201c1ddf774c12daa2dd5da098b8929db53f047'/>
<id>7201c1ddf774c12daa2dd5da098b8929db53f047</id>
<content type='text'>
Now q-&gt;now_rt is identical to q-&gt;now and is not required anymore.

Signed-off-by: Vasily Averin &lt;vvs@openvz.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Now q-&gt;now_rt is identical to q-&gt;now and is not required anymore.

Signed-off-by: Vasily Averin &lt;vvs@openvz.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
