linux-toradex.git/net, branch v3.18.21

ip_vti/ip6_vti: Preserve skb->mark after rcv_cb call

2015-08-27T17:26:14+00:00

[ Upstream commit d55c670cbc54b2270a465cdc382ce71adae45785 ]

The vti6_rcv_cb and vti_rcv_cb calls were leaving the skb->mark modified
after completing the function.  This resulted in the original skb->mark
value being lost.  Since we only need skb->mark to be set for
xfrm_policy_check we can pull the assignment into the rcv_cb calls and then
just restore the original mark after xfrm_policy_check has been completed.

Signed-off-by: Alexander Duyck 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

xfrm: Override skb->mark with tunnel->parm.i_key in xfrm_input

2015-08-27T17:26:13+00:00

[ Upstream commit 049f8e2e28d9c3dac0744cc2f19d3157c7fb5646 ]

This change makes it so that if a tunnel is defined we just use the mark
from the tunnel instead of the mark from the skb header.  By doing this we
can avoid the need to set skb->mark inside of the tunnel receive functions.

Signed-off-by: Alexander Duyck 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

ip_vti/ip6_vti: Do not touch skb->mark on xmit

2015-08-27T17:26:13+00:00

[ Upstream commit cd5279c194f89c9b97c294af4aaf4ea8c5e3c704 ]

Instead of modifying skb->mark we can simply modify the flowi_mark that is
generated as a result of the xfrm_decode_session.  By doing this we don't
need to actually touch the skb->mark and it can be preserved as it passes
out through the tunnel.

Signed-off-by: Alexander Duyck 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin

rds: rds_ib_device.refcount overflow

2015-08-27T17:25:50+00:00

[ Upstream commit 4fabb59449aa44a585b3603ffdadd4c5f4d0c033 ]

Fixes: 3e0249f9c05c ("RDS/IB: add refcount tracking to struct rds_ib_device")

There lacks a dropping on rds_ib_device.refcount in case rds_ib_alloc_fmr
failed(mr pool running out). this lead to the refcount overflow.

A complain in line 117(see following) is seen. From vmcore:
s_ib_rdma_mr_pool_depleted is 2147485544 and rds_ibdev->refcount is -2147475448.
That is the evidence the mr pool is used up. so rds_ib_alloc_fmr is very likely
to return ERR_PTR(-EAGAIN).

115 void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
116 {
117         BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
118         if (atomic_dec_and_test(&rds_ibdev->refcount))
119                 queue_work(rds_wq, &rds_ibdev->free_work);
120 }

fix is to drop refcount when rds_ib_alloc_fmr failed.

Signed-off-by: Wengang Wang 
Reviewed-by: Haggai Eran 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

mac80211: clear subdir_stations when removing debugfs

2015-08-27T17:25:43+00:00

[ Upstream commit 4479004e6409087d1b4986881dc98c6c15dffb28 ]

If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:

BUG: unable to handle kernel NULL pointer dereference at 0000006c
IP: [] mutex_lock+0x12/0x30
Call Trace:
[] start_creating+0x44/0xc0
[] debugfs_create_dir+0x13/0xf0
[] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]

Cc: stable@kernel.org
Signed-off-by: Tom Hughes 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

9p: forgetting to cancel request on interrupted zero-copy RPC

2015-08-04T18:41:41+00:00

[ Upstream commit a84b69cb6e0a41e86bc593904faa6def3b957343 ]

If we'd already sent a request and decide to abort it, we *must*
issue TFLUSH properly and not just blindly reuse the tag, or
we'll get seriously screwed when response eventually arrives
and we confuse it for response to later request that had reused
the same tag.

Cc: stable@vger.kernel.org # v3.2 and later
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

mac80211: prevent possible crypto tx tailroom corruption

2015-08-04T18:37:08+00:00

[ Upstream commit ab499db80fcf07c18e4053f91a619500f663e90e ]

There was a possible race between
ieee80211_reconfig() and
ieee80211_delayed_tailroom_dec(). This could
result in inability to transmit data if driver
crashed during roaming or rekeying and subsequent
skbs with insufficient tailroom appeared.

This race was probably never seen in the wild
because a device driver would have to crash AND
recover within 0.5s which is very unlikely.

I was able to prove this race exists after
changing the delay to 10s locally and crashing
ath10k via debugfs immediately after GTK
rekeying. In case of ath10k the counter went below
0. This was harmless but other drivers which
actually require tailroom (e.g. for WEP ICV or
MMIC) could end up with the counter at 0 instead
of >0 and introduce insufficient skb tailroom
failures because mac80211 would not resize skbs
appropriately anymore.

Fixes: 8d1f7ecd2af5 ("mac80211: defer tailroom counter manipulation when roaming")
Signed-off-by: Michal Kazior 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin

Revert "can: fix loss of CAN frames in raw_rcv"

2015-08-04T17:32:39+00:00

This reverts commit c215cf258214858a5a6c3e63cd7ee78b92d210b2.

Signed-off-by: Sasha Levin

rtnl: restore notifications for deleted interfaces

2015-07-21T01:12:45+00:00

The commit 984ff7a3e060 is an upstream backport. In fact, it depends on
commit 395eea6ccf2b ("rtnetlink: delay RTM_DELLINK notification until after ndo_uninit()")
which has not been backported in 3.18.y.

Before commit 395eea6ccf2b, rollback_registered_many() uses rtmsg_ifinfo().
The call to this function is done with dev->reg_state set to
NETREG_UNREGISTERING, thus testing this reg_state in rtmsg_ifinfo() is
wrong.

This patch partially reverts commit 984ff7a3e060.

Fixes: 984ff7a3e060 ("rtnl/bond: don't send rtnl msg for unregistered iface")
Reported-by: Kristian Evensen 
Signed-off-by: Nicolas Dichtel 
Signed-off-by: Sasha Levin

netfilter: nf_tables: allow to change chain policy without hook if it exists

2015-07-13T12:50:05+00:00

[ Upstream commit d6b6cb1d3e6f78d55c2d4043d77d0d8def3f3b99 ]

If there's an existing base chain, we have to allow to change the
default policy without indicating the hook information.

However, if the chain doesn't exists, we have to enforce the presence of
the hook attribute.

Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin