* Hello
From: Johnson Ato @ 2011-03-13 12:50 UTC (permalink / raw)
--
Dear Friend,
I got your email address on the internet, I want you to assist
me by getting a nice property for purchase within your location
as me and my family wants to relocate to a safe environment as
soon as possible due to the crisis in my country.
Your urgent response is highly appreciated.
Johnson Ato
----------------------------------------------------------------
^ permalink raw reply
* Re: [PATCH] ipv4: netfilter: ipt_CLUSTERIP: fix buffer overflow
From: Changli Gao @ 2011-03-13 14:00 UTC (permalink / raw)
To: Vasiliy Kulikov
Cc: linux-kernel, security, Patrick McHardy, David S. Miller,
Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI,
netfilter-devel, netfilter, coreteam, netdev
In-Reply-To: <1299780740-32652-1-git-send-email-segoon@openwall.com>
On Fri, Mar 11, 2011 at 2:12 AM, Vasiliy Kulikov <segoon@openwall.com> wrote:
> buffer string is copied from userspace. It is not checked whether it is
> zero terminated. This may lead to overflow inside of simple_strtoul().
>
> It was introduced before the git epoch. Files "ipt_CLUSTERIP/*" are
> root writable only by default, however, on some setups permissions might be
> relaxed to e.g. network admin user.
>
> Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
> ---
> Compile tested.
>
> net/ipv4/netfilter/ipt_CLUSTERIP.c | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
> index 403ca57..7aabf9a 100644
> --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
> +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
> @@ -666,6 +666,7 @@ static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
>
> if (copy_from_user(buffer, input, PROC_WRITELEN))
I think size should be used instead of PROC_WRITELEN.
if (size > PROC_WRITELEN)
return -EIO;
if (copy_from_user(buffer, input, size))
return -EFAULT;
buffer[size] = '\0';
> return -EFAULT;
> + buffer[sizeof(buffer)-1] = 0;
>
> if (*buffer == '+') {
> nodenum = simple_strtoul(buffer+1, NULL, 10);
--
Regards,
Changli Gao(xiaosuo@gmail.com)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Hello
From: Johnson Ato @ 2011-03-13 13:36 UTC (permalink / raw)
--
Dear Friend,
I got your email address on the internet, I want you to assist
me by getting a nice property for purchase within your location
as me and my family wants to relocate to a safe environment as
soon as possible due to the crisis in my country.
Your urgent response is highly appreciated.
Johnson Ato
----------------------------------------------------------------
^ permalink raw reply
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Michael S. Tsirkin @ 2011-03-13 15:06 UTC (permalink / raw)
To: Jason Wang; +Cc: virtualization, netdev, kvm, linux-kernel
In-Reply-To: <20110117081117.18900.48672.stgit@dhcp-91-7.nay.redhat.com.englab.nay.redhat.com>
On Mon, Jan 17, 2011 at 04:11:17PM +0800, Jason Wang wrote:
> We can use lock_sock_fast() instead of lock_sock() in order to get
> speedup in peek_head_len().
>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> drivers/vhost/net.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index c32a2e4..50b622a 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -211,12 +211,12 @@ static int peek_head_len(struct sock *sk)
> {
> struct sk_buff *head;
> int len = 0;
> + bool slow = lock_sock_fast(sk);
>
> - lock_sock(sk);
> head = skb_peek(&sk->sk_receive_queue);
> if (head)
> len = head->len;
> - release_sock(sk);
> + unlock_sock_fast(sk, slow);
> return len;
> }
>
Wanted to apply this, but looking at the code I think the lock_sock here
is wrong. What we really need is to handle the case where the skb is
pulled from the receive queue after skb_peek. However this is not the
right lock to use for that, sk_receive_queue.lock is.
So I expect the following is the right way to handle this.
Comments?
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 0329c41..5720301 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -213,12 +213,13 @@ static int peek_head_len(struct sock *sk)
{
struct sk_buff *head;
int len = 0;
+ unsigned long flags;
- lock_sock(sk);
+ spin_lock_irqsave(&sk->sk_receive_queue.lock, flags);
head = skb_peek(&sk->sk_receive_queue);
- if (head)
+ if (likely(head))
len = head->len;
- release_sock(sk);
+ spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
return len;
}
^ permalink raw reply related
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Eric Dumazet @ 2011-03-13 15:52 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: Jason Wang, virtualization, netdev, kvm, linux-kernel
In-Reply-To: <20110313150646.GA30494@redhat.com>
Le dimanche 13 mars 2011 à 17:06 +0200, Michael S. Tsirkin a écrit :
> On Mon, Jan 17, 2011 at 04:11:17PM +0800, Jason Wang wrote:
> > We can use lock_sock_fast() instead of lock_sock() in order to get
> > speedup in peek_head_len().
> >
> > Signed-off-by: Jason Wang <jasowang@redhat.com>
> > ---
> > drivers/vhost/net.c | 4 ++--
> > 1 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > index c32a2e4..50b622a 100644
> > --- a/drivers/vhost/net.c
> > +++ b/drivers/vhost/net.c
> > @@ -211,12 +211,12 @@ static int peek_head_len(struct sock *sk)
> > {
> > struct sk_buff *head;
> > int len = 0;
> > + bool slow = lock_sock_fast(sk);
> >
> > - lock_sock(sk);
> > head = skb_peek(&sk->sk_receive_queue);
> > if (head)
> > len = head->len;
> > - release_sock(sk);
> > + unlock_sock_fast(sk, slow);
> > return len;
> > }
> >
>
> Wanted to apply this, but looking at the code I think the lock_sock here
> is wrong. What we really need is to handle the case where the skb is
> pulled from the receive queue after skb_peek. However this is not the
> right lock to use for that, sk_receive_queue.lock is.
> So I expect the following is the right way to handle this.
> Comments?
>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 0329c41..5720301 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -213,12 +213,13 @@ static int peek_head_len(struct sock *sk)
> {
> struct sk_buff *head;
> int len = 0;
> + unsigned long flags;
>
> - lock_sock(sk);
> + spin_lock_irqsave(&sk->sk_receive_queue.lock, flags);
> head = skb_peek(&sk->sk_receive_queue);
> - if (head)
> + if (likely(head))
> len = head->len;
> - release_sock(sk);
> + spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
> return len;
> }
>
You may be right, only way to be sure is to check the other side.
If it uses skb_queue_tail(), then yes, your patch is fine.
If other side did not lock socket, then your patch is a bug fix.
^ permalink raw reply
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Michael S. Tsirkin @ 2011-03-13 16:19 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Jason Wang, virtualization, netdev, kvm, linux-kernel
In-Reply-To: <1300031570.2761.22.camel@edumazet-laptop>
On Sun, Mar 13, 2011 at 04:52:50PM +0100, Eric Dumazet wrote:
> Le dimanche 13 mars 2011 à 17:06 +0200, Michael S. Tsirkin a écrit :
> > On Mon, Jan 17, 2011 at 04:11:17PM +0800, Jason Wang wrote:
> > > We can use lock_sock_fast() instead of lock_sock() in order to get
> > > speedup in peek_head_len().
> > >
> > > Signed-off-by: Jason Wang <jasowang@redhat.com>
> > > ---
> > > drivers/vhost/net.c | 4 ++--
> > > 1 files changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > > index c32a2e4..50b622a 100644
> > > --- a/drivers/vhost/net.c
> > > +++ b/drivers/vhost/net.c
> > > @@ -211,12 +211,12 @@ static int peek_head_len(struct sock *sk)
> > > {
> > > struct sk_buff *head;
> > > int len = 0;
> > > + bool slow = lock_sock_fast(sk);
> > >
> > > - lock_sock(sk);
> > > head = skb_peek(&sk->sk_receive_queue);
> > > if (head)
> > > len = head->len;
> > > - release_sock(sk);
> > > + unlock_sock_fast(sk, slow);
> > > return len;
> > > }
> > >
> >
> > Wanted to apply this, but looking at the code I think the lock_sock here
> > is wrong. What we really need is to handle the case where the skb is
> > pulled from the receive queue after skb_peek. However this is not the
> > right lock to use for that, sk_receive_queue.lock is.
> > So I expect the following is the right way to handle this.
> > Comments?
> >
> > Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> >
> > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > index 0329c41..5720301 100644
> > --- a/drivers/vhost/net.c
> > +++ b/drivers/vhost/net.c
> > @@ -213,12 +213,13 @@ static int peek_head_len(struct sock *sk)
> > {
> > struct sk_buff *head;
> > int len = 0;
> > + unsigned long flags;
> >
> > - lock_sock(sk);
> > + spin_lock_irqsave(&sk->sk_receive_queue.lock, flags);
> > head = skb_peek(&sk->sk_receive_queue);
> > - if (head)
> > + if (likely(head))
> > len = head->len;
> > - release_sock(sk);
> > + spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
> > return len;
> > }
> >
>
> You may be right, only way to be sure is to check the other side.
>
> If it uses skb_queue_tail(), then yes, your patch is fine.
>
> If other side did not lock socket, then your patch is a bug fix.
>
>
Other side is in drivers/net/tun.c and net/packet/af_packet.c
At least wrt tun it seems clear socket is not locked.
Besides queue, dequeue seems to be done without socket locked.
--
MST
^ permalink raw reply
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Eric Dumazet @ 2011-03-13 16:32 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: Jason Wang, virtualization, netdev, kvm, linux-kernel
In-Reply-To: <20110313161915.GB30642@redhat.com>
Le dimanche 13 mars 2011 à 18:19 +0200, Michael S. Tsirkin a écrit :
> Other side is in drivers/net/tun.c and net/packet/af_packet.c
> At least wrt tun it seems clear socket is not locked.
Yes (assuming you refer to tun_net_xmit())
> Besides queue, dequeue seems to be done without socket locked.
>
It seems this code (assuming you speak of drivers/vhost/net.c ?) has
some races indeed.
^ permalink raw reply
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Michael S. Tsirkin @ 2011-03-13 16:43 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Jason Wang, virtualization, netdev, kvm, linux-kernel
In-Reply-To: <1300033927.2761.26.camel@edumazet-laptop>
On Sun, Mar 13, 2011 at 05:32:07PM +0100, Eric Dumazet wrote:
> Le dimanche 13 mars 2011 à 18:19 +0200, Michael S. Tsirkin a écrit :
>
> > Other side is in drivers/net/tun.c and net/packet/af_packet.c
> > At least wrt tun it seems clear socket is not locked.
>
> Yes (assuming you refer to tun_net_xmit())
>
> > Besides queue, dequeue seems to be done without socket locked.
> >
>
> It seems this code (assuming you speak of drivers/vhost/net.c ?) has
> some races indeed.
>
Hmm. Any more besides the one fixed here?
--
MST
^ permalink raw reply
* [PATCH 1/2] NET: cdc-phonet, fix stop-queue handling
From: Jiri Slaby @ 2011-03-13 16:54 UTC (permalink / raw)
To: davem
Cc: jirislaby, netdev, gregkh, linux-usb, linux-kernel, Jiri Slaby,
Rémi Denis-Courmont
Currently there is a warning emitted by the cdc-phonet driver:
WARNING: at include/linux/netdevice.h:1557 usbpn_probe+0x3bb/0x3f0 [cdc_phonet]()
Modules linked in: ...
Pid: 5877, comm: insmod Not tainted 2.6.37.3-16-desktop #1
Call Trace:
[<ffffffff810059b9>] dump_trace+0x79/0x340
[<ffffffff81520fdc>] dump_stack+0x69/0x6f
[<ffffffff810580eb>] warn_slowpath_common+0x7b/0xc0
[<ffffffffa00254fb>] usbpn_probe+0x3bb/0x3f0 [cdc_phonet]
...
---[ end trace f5d3e02908603ab4 ]---
netif_stop_queue() cannot be called before register_netdev()
So remove netif_stop_queue from the probe funtction to avoid that.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Cc: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/cdc-phonet.c | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index 109751b..4cf4e36 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -392,7 +392,6 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
pnd = netdev_priv(dev);
SET_NETDEV_DEV(dev, &intf->dev);
- netif_stop_queue(dev);
pnd->dev = dev;
pnd->usb = usb_get_dev(usbdev);
--
1.7.4.1
^ permalink raw reply related
* [PATCH 2/2] NET: cdc-phonet, handle empty phonet header
From: Jiri Slaby @ 2011-03-13 16:54 UTC (permalink / raw)
To: davem
Cc: jirislaby, netdev, gregkh, linux-usb, linux-kernel, Jiri Slaby,
Rémi Denis-Courmont
In-Reply-To: <1300035271-8138-1-git-send-email-jslaby@suse.cz>
Currently, for N 5800 XM I get:
cdc_phonet: probe of 1-6:1.10 failed with error -22
It's because phonet_header is empty. Extra altsetting looks like
there:
E 05 24 00 01 10 03 24 ab 05 24 06 0a 0b 04 24 fd .$....$..$....$.
E 00 .
I don't see the header used anywhere so just check if the phonet
descriptor is there, not the structure itself.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Cc: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/cdc-phonet.c | 9 +++------
1 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index 4cf4e36..f967913 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -328,13 +328,13 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
{
static const char ifname[] = "usbpn%d";
const struct usb_cdc_union_desc *union_header = NULL;
- const struct usb_cdc_header_desc *phonet_header = NULL;
const struct usb_host_interface *data_desc;
struct usb_interface *data_intf;
struct usb_device *usbdev = interface_to_usbdev(intf);
struct net_device *dev;
struct usbpn_dev *pnd;
u8 *data;
+ int phonet = 0;
int len, err;
data = intf->altsetting->extra;
@@ -355,10 +355,7 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
(struct usb_cdc_union_desc *)data;
break;
case 0xAB:
- if (phonet_header || dlen < 5)
- break;
- phonet_header =
- (struct usb_cdc_header_desc *)data;
+ phonet = 1;
break;
}
}
@@ -366,7 +363,7 @@ int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *id)
len -= dlen;
}
- if (!union_header || !phonet_header)
+ if (!union_header || !phonet)
return -EINVAL;
data_intf = usb_ifnum_to_if(usbdev, union_header->bSlaveInterface0);
--
1.7.4.1
^ permalink raw reply related
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Eric Dumazet @ 2011-03-13 17:41 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: Jason Wang, virtualization, netdev, kvm, linux-kernel
In-Reply-To: <20110313164359.GA32562@redhat.com>
Le dimanche 13 mars 2011 à 18:43 +0200, Michael S. Tsirkin a écrit :
> On Sun, Mar 13, 2011 at 05:32:07PM +0100, Eric Dumazet wrote:
> > Le dimanche 13 mars 2011 à 18:19 +0200, Michael S. Tsirkin a écrit :
> >
> > > Other side is in drivers/net/tun.c and net/packet/af_packet.c
> > > At least wrt tun it seems clear socket is not locked.
> >
> > Yes (assuming you refer to tun_net_xmit())
> >
> > > Besides queue, dequeue seems to be done without socket locked.
> > >
> >
> > It seems this code (assuming you speak of drivers/vhost/net.c ?) has
> > some races indeed.
> >
>
> Hmm. Any more besides the one fixed here?
>
If writers and readers dont share a common lock, how can they reliably
synchronize states ?
For example, the check at line 420 seems unsafe or useless.
skb_queue_empty(&sock->sk->sk_receive_queue)
^ permalink raw reply
* [PATCH] af_unix: update locking comment
From: dbaluta @ 2011-03-13 20:11 UTC (permalink / raw)
To: davem; +Cc: eric.dumazet, netdev, Daniel Baluta, Daniel Baluta
From: Daniel Baluta <daniel.baluta@gmail.com>
We latch our state using a spinlock not a r/w kind of lock.
Signed-off-by: Daniel Baluta <dbaluta@ixiacom.com>
---
net/unix/af_unix.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index de87018..ef70615 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1124,7 +1124,7 @@ restart:
/* Latch our state.
- It is tricky place. We need to grab write lock and cannot
+ It is tricky place. We need to grab our state lock and cannot
drop lock on peer. It is dangerous because deadlock is
possible. Connect to self case and simultaneous
attempt to connect are eliminated by checking socket
--
1.7.1
^ permalink raw reply related
* Re: [PATCH] net: add Faraday FTGMAC100 Gigabit Ethernet driver
From: Eric Dumazet @ 2011-03-13 20:16 UTC (permalink / raw)
To: Po-Yu Chuang; +Cc: netdev, linux-kernel, Po-Yu Chuang
In-Reply-To: <1299744517-1896-1-git-send-email-ratbert.chuang@gmail.com>
Le jeudi 10 mars 2011 à 16:08 +0800, Po-Yu Chuang a écrit :
> From: Po-Yu Chuang <ratbert@faraday-tech.com>
>
> FTGMAC100 Ethernet Media Access Controller supports 10/100/1000 Mbps
> and MII/GMII. This driver has been working on some ARM/NDS32 SoC's
> including Faraday A369 and Andes AG102.
>
Hi
It seems very close from drivers/net/ftmac100.c one. Are you sure a
factorization is not possible ?
BTW, it seems I missed the fact that ftmac100_alloc_rx_page() used a
GFP_KERNEL allocation, while its called from softirq context (from
ftmac100_rx_packet())
Same problem of course in this Gigabit driver.
^ permalink raw reply
* [PATCH net-next-2.6] ftmac100: use GFP_ATOMIC allocations where needed
From: Eric Dumazet @ 2011-03-13 20:26 UTC (permalink / raw)
To: Po-Yu Chuang; +Cc: netdev, linux-kernel, Po-Yu Chuang
In-Reply-To: <1300047388.2761.48.camel@edumazet-laptop>
Le dimanche 13 mars 2011 à 21:16 +0100, Eric Dumazet a écrit :
> BTW, it seems I missed the fact that ftmac100_alloc_rx_page() used a
> GFP_KERNEL allocation, while its called from softirq context (from
> ftmac100_rx_packet())
Here is a patch against ftmac100
[PATCH net-next-2.6] ftmac100: use GFP_ATOMIC allocations where needed
When running in softirq context, we should use GFP_ATOMIC allocations
instead of GFP_KERNEL ones.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
drivers/net/ftmac100.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ftmac100.c b/drivers/net/ftmac100.c
index df70368..76cf77a 100644
--- a/drivers/net/ftmac100.c
+++ b/drivers/net/ftmac100.c
@@ -80,7 +80,8 @@ struct ftmac100 {
struct mii_if_info mii;
};
-static int ftmac100_alloc_rx_page(struct ftmac100 *priv, struct ftmac100_rxdes *rxdes);
+static int ftmac100_alloc_rx_page(struct ftmac100 *priv,
+ struct ftmac100_rxdes *rxdes, gfp_t gfp);
/******************************************************************************
* internal functions (hardware register access)
@@ -441,7 +442,7 @@ static bool ftmac100_rx_packet(struct ftmac100 *priv, int *processed)
skb->truesize += length;
__pskb_pull_tail(skb, min(length, 64));
- ftmac100_alloc_rx_page(priv, rxdes);
+ ftmac100_alloc_rx_page(priv, rxdes, GFP_ATOMIC);
ftmac100_rx_pointer_advance(priv);
@@ -659,13 +660,14 @@ static int ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
/******************************************************************************
* internal functions (buffer)
*****************************************************************************/
-static int ftmac100_alloc_rx_page(struct ftmac100 *priv, struct ftmac100_rxdes *rxdes)
+static int ftmac100_alloc_rx_page(struct ftmac100 *priv,
+ struct ftmac100_rxdes *rxdes, gtp_t gfp)
{
struct net_device *netdev = priv->netdev;
struct page *page;
dma_addr_t map;
- page = alloc_page(GFP_KERNEL);
+ page = alloc_page(gfp);
if (!page) {
if (net_ratelimit())
netdev_err(netdev, "failed to allocate rx page\n");
@@ -736,7 +738,7 @@ static int ftmac100_alloc_buffers(struct ftmac100 *priv)
for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
struct ftmac100_rxdes *rxdes = &priv->descs->rxdes[i];
- if (ftmac100_alloc_rx_page(priv, rxdes))
+ if (ftmac100_alloc_rx_page(priv, rxdes, GFP_KERNEL))
goto err;
}
^ permalink raw reply related
* Re: [PATCH net-next-2.6] ftmac100: use GFP_ATOMIC allocations where needed
From: Eric Dumazet @ 2011-03-13 20:29 UTC (permalink / raw)
To: Po-Yu Chuang; +Cc: netdev, linux-kernel, Po-Yu Chuang
In-Reply-To: <1300048002.2761.53.camel@edumazet-laptop>
Le dimanche 13 mars 2011 à 21:26 +0100, Eric Dumazet a écrit :
> Le dimanche 13 mars 2011 à 21:16 +0100, Eric Dumazet a écrit :
>
> > BTW, it seems I missed the fact that ftmac100_alloc_rx_page() used a
> > GFP_KERNEL allocation, while its called from softirq context (from
> > ftmac100_rx_packet())
>
> Here is a patch against ftmac100
>
Oops, one typo in it sorry
> -static int ftmac100_alloc_rx_page(struct ftmac100 *priv, struct ftmac100_rxdes *rxdes)
> +static int ftmac100_alloc_rx_page(struct ftmac100 *priv,
> + struct ftmac100_rxdes *rxdes, gtp_t gfp)
Should be : gfp_t gfp
Please build and test the patch, I dont have an ARM testbed anyway.
Thanks
^ permalink raw reply
* [PATCH] bonding: documentation update: mailing lists.
From: Nicolas de Pesloüan @ 2011-03-13 20:34 UTC (permalink / raw)
To: fubar, andy; +Cc: netdev, Nicolas de Pesloüan
In commit a6c36ee677607b02d8ecc88e8a12785418b88107 ("bonding: change list
contact to netdev@vger.kernel.org"), the mailing list for bonding
developpement was changed from bonding-devel to netdev.
Update the bonding documentation to reflect this change:
- bonding-devel is used for usage discussions (despite the name).
- netdev is used for developpement discussions.
Also remove the reference to the sourceforge bonding page, which is
deprecated.
Signed-off-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
---
Documentation/networking/bonding.txt | 26 +++++++++++++++++---------
1 files changed, 17 insertions(+), 9 deletions(-)
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 25d2f41..b36e741 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -2558,18 +2558,15 @@ enslaved.
16. Resources and Links
=======================
-The latest version of the bonding driver can be found in the latest
+ The latest version of the bonding driver can be found in the latest
version of the linux kernel, found on http://kernel.org
-The latest version of this document can be found in either the latest
-kernel source (named Documentation/networking/bonding.txt), or on the
-bonding sourceforge site:
+ The latest version of this document can be found in the latest kernel
+source (named Documentation/networking/bonding.txt).
-http://www.sourceforge.net/projects/bonding
-
-Discussions regarding the bonding driver take place primarily on the
-bonding-devel mailing list, hosted at sourceforge.net. If you have
-questions or problems, post them to the list. The list address is:
+ Discussions regarding the usage of the bonding driver take place on the
+bonding-devel mailing list, hosted at sourceforge.net. If you have questions or
+problems, post them to the list. The list address is:
bonding-devel@lists.sourceforge.net
@@ -2578,6 +2575,17 @@ be found at:
https://lists.sourceforge.net/lists/listinfo/bonding-devel
+ Discussions regarding the developpement of the bonding driver take place
+on the main Linux network mailing list, hosted at vger.kernel.org. The list
+address is:
+
+netdev@vger.kernel.org
+
+ The administrative interface (to subscribe or unsubscribe) can
+be found at:
+
+http://vger.kernel.org/vger-lists.html#netdev
+
Donald Becker's Ethernet Drivers and diag programs may be found at :
- http://web.archive.org/web/*/http://www.scyld.com/network/
--
1.7.2.3
^ permalink raw reply related
* Re: dccp test-tree [RFC] [Patch 1/1] dccp: Only activate NN values after receiving the Confirm option
From: Samuel Jero @ 2011-03-13 20:34 UTC (permalink / raw)
To: Gerrit Renker; +Cc: dccp, netdev
In-Reply-To: <20110311113042.GB4876@gerrit.erg.abdn.ac.uk>
[-- Attachment #1: Type: text/plain, Size: 3072 bytes --]
> Well done, this looks good. I did some minor editing:
> * whitespace/formatting/comments,
> * simplification/subsumption,
> * function should not be called for non-NN or non-known
> feature, hence turned that into a DCCP_BUG() condition.
Okay
>
> | 2)In a situation where the ack ratio has to be reduced because of an
> | RTO, idle period, or loss, CCID-2 now sets the ack ratio to half of the
> | congestion window (or 1 if that's zero) instead of to the congestion
> | window. This should reduce the problems if one ack is lost (we have to
> | lose two acks to not acknowledge an entire congestion window and trigger
> | RTO)
> |
> I think this makes for a separate patch, and it would be good to commentify
> the above into the code; please also see 3(b) below.
Separate patch coming shortly. Will add comment describing the
situation.
> Some work still remains to be done:
>
> 1) Since ccid2_ack_ratio_next(sk) is just a wrapper around
> dccp_feat_get_nn_next_val(sk, DCCPF_ACK_RATIO), ok to
> use this instead?
It's just fine to use dccp_feat_get_nn_next_val() instead. My primary
reason for creating ccid2_ack_ratio_next() was to keep line lengths
down.
> 2) Analogously, for the local sequence window feature the
> dccp_feat_get_nn_next_val() is not used, it uses the
> current value:
> if (val != dp->dccps_l_seq_win)
> dccp_feat_signal_nn_change(sk, DCCPF_SEQUENCE_WINDOW, val);
That should also be updated to use dccp_feat_get_nn_next_val(sk,
DCCPF_SEQUENCE_WINDOW)
> 3) There is room for some refactoring:
> a) dccp_feat_signal_nn_change() always implies also in part
> dccp_feat_get_nn_next_val(): if the latter function returns
> the same value as the supposedly 'new' one, it is not
> necessary to start a new negotiation. So all the repeated
> tests could be folded into that function.
The problem here is that the ack ratio should only be changed after a
loss, idle period, etc if the new cwnd is going to be less than the
(negotiating) ack ratio. We need to call dccp_feat_get_nn_next_val() to
decide whether we need to adjust the ack ratio or not.
We don't want to change the ack ratio every time we have a loss, etc.
Doing so will result in pointless negotiations and more fluctuations in
the ack ratio, neither of which is desirable.
> b) The following pattern appears three times in ccid2.c:
> if (ccid2_ack_ratio_next(sk) > hc->tx_cwnd)
> ccid2_change_l_ack_ratio(sk, hc->tx_cwnd/2 ? : 1U);
> Perhaps this can, as some other parts of this patch set, be
> refactored (e.g. the CCID-2 part is already a separate patch).
I'll create a function for this code. Coming in separate patch.
>
> Other than the minor edits I have left your patch as is, i.e. I have
> not yet performed changes (1) and (2), awaiting your opinion on that.
Go ahead with 1) and 2). I'll send out a new patch for 3 (b) shortly.
Samuel Jero
Internetworking Research Group
Ohio University
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]
^ permalink raw reply
* Re: [PATCH 3/3] vhost-net: use lock_sock_fast() in peek_head_len()
From: Michael S. Tsirkin @ 2011-03-13 21:11 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Jason Wang, virtualization, netdev, kvm, linux-kernel
In-Reply-To: <1300038092.2761.41.camel@edumazet-laptop>
On Sun, Mar 13, 2011 at 06:41:32PM +0100, Eric Dumazet wrote:
> Le dimanche 13 mars 2011 à 18:43 +0200, Michael S. Tsirkin a écrit :
> > On Sun, Mar 13, 2011 at 05:32:07PM +0100, Eric Dumazet wrote:
> > > Le dimanche 13 mars 2011 à 18:19 +0200, Michael S. Tsirkin a écrit :
> > >
> > > > Other side is in drivers/net/tun.c and net/packet/af_packet.c
> > > > At least wrt tun it seems clear socket is not locked.
> > >
> > > Yes (assuming you refer to tun_net_xmit())
> > >
> > > > Besides queue, dequeue seems to be done without socket locked.
> > > >
> > >
> > > It seems this code (assuming you speak of drivers/vhost/net.c ?) has
> > > some races indeed.
> > >
> >
> > Hmm. Any more besides the one fixed here?
> >
>
> If writers and readers dont share a common lock, how can they reliably
> synchronize states ?
They are all supposed to use sk_receive_queue.lock I think.
> For example, the check at line 420 seems unsafe or useless.
>
> skb_queue_empty(&sock->sk->sk_receive_queue)
>
It's mostly useless: code that is called after this
does skb_peek and checks the result under the spinlock.
This was supposed to be an optimization: quickly check
that queue is not empty before we bother disabling notifications
etc, but I dont' remember at this point whether it actually gives any gain.
Thanks for pointing this out, I'll take it out I think (below).
Note: there are two places of this call in upstream: handle_rx_bug and
handle_rx_mergeable, but they are merged into a single
handle_rx by a patch by Jason Wang.
The below patch is on top.
If you like to look at the latest code,
it's here master.kernel.org:/home/mst/pub/vhost.git
branch vhost-net-next has it all.
Eric, thanks very much for pointing out these.
Is there anything else that you see in this driver?
Thanks!
vhost-net: remove unlocked use of receive_queue
Use of skb_queue_empty(&sock->sk->sk_receive_queue)
without taking the sk_receive_queue.lock is unsafe
or useless. Take it out.
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 5720301..2f7c76a 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -311,7 +311,7 @@ static void handle_rx(struct vhost_net *net)
/* TODO: check that we are running from vhost_worker? */
struct socket *sock = rcu_dereference_check(vq->private_data, 1);
- if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue))
+ if (!sock)
return;
mutex_lock(&vq->mutex);
^ permalink raw reply related
* Validation
From: Mrs. Marcia Spade @ 2011-03-13 18:16 UTC (permalink / raw)
Your E-mail account have been picked for a lump sum pay out of 891,934.00 GBP
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
^ permalink raw reply
* [PATCH net-next 00/26] tipc: Yet another mixed bag of updates
From: Paul Gortmaker @ 2011-03-13 21:33 UTC (permalink / raw)
To: davem; +Cc: netdev, Allan.Stephens, Paul Gortmaker
Content varies, from cleanups to bugfixes to removals of orphaned code.
In the new functionality department, there is the SO_RCVTIMEO sockopt
and the multi-chunk iovec changes that simply were not supported before.
In the removal dep't there were a couple more blocks relating to the
now-gone prototype routing that can also now be deleted.
Nobody likes Kconfig options for micro tuning anymore, so one of those
gets shot in the head, which triggered a bunch of associated cleanups,
like the killing off of a largely useless global structure.
The remainder are either bugfixes or cosmetic cleanups initiated by
the bugfix; with the usual intent of not mixing both types of content
within a single commit, so that review/inspection is hopefully easier.
Thanks,
Paul.
---
The following changes since commit bef55aebd560c5a6f8883c421abccee39978c58c:
decnet: Convert to use flowidn where applicable. (2011-03-12 15:08:55 -0800)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/paulg/net-next-2.6.git tipc-Mar13-2011
Allan Stephens (25):
tipc: Allow receiving into iovec containing multiple entries
tipc: Correct broadcast link peer info when displaying links
tipc: Add network address mask helper routines
tipc: Prevent null pointer error when removing a node subscription
tipc: Cosmetic changes to node subscription code
tipc: Add support for SO_RCVTIMEO socket option
tipc: Fix problem with missing link in "tipc-config -l" output
tipc: Split up unified structure of network-related variables
tipc: Eliminate configuration for maximum number of cluster nodes
tipc: Convert node object array to a hash table
tipc: manually inline net_start/stop, make assoc. vars static
tipc: Eliminate timestamp from link protocol messages
tipc: make msg_set_redundant_link() consistent with other set ops
tipc: Fix redundant link field handling in link protocol message
tipc: Cosmetic changes to neighbor discovery logic
tipc: Give Tx of discovery responses priority over link messages
tipc: Optimizations to link creation code
tipc: Correct misnamed references to neighbor discovery domain
tipc: Remove unused field in bearer structure
tipc: Eliminate unnecessary constant for neighbor discovery msg size
tipc: Don't respond to neighbor discovery request on blocked bearer
tipc: Remove bearer flag indicating existence of broadcast address
tipc: Eliminate remaining support for routing table messages
tipc: Eliminate obsolete routine for handling routed messages
tipc: Update maintenance information
Paul Gortmaker (1):
tipc: cosmetic - function names are not to be full sentences
MAINTAINERS | 6 +--
include/linux/tipc_config.h | 6 +-
net/tipc/Kconfig | 12 ----
net/tipc/addr.c | 15 ++----
net/tipc/addr.h | 17 +++++--
net/tipc/bearer.c | 18 +++----
net/tipc/bearer.h | 6 +--
net/tipc/config.c | 31 ++---------
net/tipc/core.c | 6 --
net/tipc/core.h | 1 -
net/tipc/discover.c | 103 +++++++++++++++++++++---------------
net/tipc/link.c | 50 ++++++++++-------
net/tipc/link.h | 3 +-
net/tipc/msg.c | 34 ------------
net/tipc/msg.h | 42 +--------------
net/tipc/name_distr.c | 18 +++---
net/tipc/net.c | 32 ++---------
net/tipc/net.h | 19 +------
net/tipc/node.c | 123 ++++++++++++++++++++-----------------------
net/tipc/node.h | 36 ++++++++-----
net/tipc/node_subscr.c | 21 +++++++-
net/tipc/node_subscr.h | 3 +-
net/tipc/socket.c | 70 +++++++++++-------------
23 files changed, 278 insertions(+), 394 deletions(-)
--
1.7.3.3
^ permalink raw reply
* [PATCH net-next 01/26] tipc: Allow receiving into iovec containing multiple entries
From: Paul Gortmaker @ 2011-03-13 21:33 UTC (permalink / raw)
To: davem; +Cc: netdev, Allan.Stephens, Paul Gortmaker
In-Reply-To: <1300052054-7531-1-git-send-email-paul.gortmaker@windriver.com>
From: Allan Stephens <Allan.Stephens@windriver.com>
Enhances TIPC's socket receive routines to support iovec structures
containing more than a single entry. This change leverages existing
sk_buff routines to do most of the work; the only significant change
to TIPC itself is that an sk_buff now records how much data has been
already consumed as an numeric offset, rather than as a pointer to
the first unread data byte.
Signed-off-by: Allan Stephens <Allan.Stephens@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/tipc/socket.c | 38 +++++++++++++++-----------------------
1 files changed, 15 insertions(+), 23 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 125dcb0..d45a294 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -289,7 +289,7 @@ static int release(struct socket *sock)
if (buf == NULL)
break;
atomic_dec(&tipc_queue_size);
- if (TIPC_SKB_CB(buf)->handle != msg_data(buf_msg(buf)))
+ if (TIPC_SKB_CB(buf)->handle != 0)
buf_discard(buf);
else {
if ((sock->state == SS_CONNECTING) ||
@@ -917,9 +917,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
/* Catch invalid receive requests */
- if (m->msg_iovlen != 1)
- return -EOPNOTSUPP; /* Don't do multiple iovec entries yet */
-
if (unlikely(!buf_len))
return -EINVAL;
@@ -991,11 +988,10 @@ restart:
sz = buf_len;
m->msg_flags |= MSG_TRUNC;
}
- if (unlikely(copy_to_user(m->msg_iov->iov_base, msg_data(msg),
- sz))) {
- res = -EFAULT;
+ res = skb_copy_datagram_iovec(buf, msg_hdr_sz(msg),
+ m->msg_iov, sz);
+ if (res)
goto exit;
- }
res = sz;
} else {
if ((sock->state == SS_READY) ||
@@ -1041,16 +1037,11 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
unsigned int sz;
int sz_to_copy, target, needed;
int sz_copied = 0;
- char __user *crs = m->msg_iov->iov_base;
- unsigned char *buf_crs;
u32 err;
int res = 0;
/* Catch invalid receive attempts */
- if (m->msg_iovlen != 1)
- return -EOPNOTSUPP; /* Don't do multiple iovec entries yet */
-
if (unlikely(!buf_len))
return -EINVAL;
@@ -1112,24 +1103,25 @@ restart:
/* Capture message data (if valid) & compute return value (always) */
if (!err) {
- buf_crs = (unsigned char *)(TIPC_SKB_CB(buf)->handle);
- sz = (unsigned char *)msg + msg_size(msg) - buf_crs;
+ u32 offset = (u32)(unsigned long)(TIPC_SKB_CB(buf)->handle);
+ sz -= offset;
needed = (buf_len - sz_copied);
sz_to_copy = (sz <= needed) ? sz : needed;
- if (unlikely(copy_to_user(crs, buf_crs, sz_to_copy))) {
- res = -EFAULT;
+
+ res = skb_copy_datagram_iovec(buf, msg_hdr_sz(msg) + offset,
+ m->msg_iov, sz_to_copy);
+ if (res)
goto exit;
- }
+
sz_copied += sz_to_copy;
if (sz_to_copy < sz) {
if (!(flags & MSG_PEEK))
- TIPC_SKB_CB(buf)->handle = buf_crs + sz_to_copy;
+ TIPC_SKB_CB(buf)->handle =
+ (void *)(unsigned long)(offset + sz_to_copy);
goto exit;
}
-
- crs += sz_to_copy;
} else {
if (sz_copied != 0)
goto exit; /* can't add error msg to valid data */
@@ -1256,7 +1248,7 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
/* Enqueue message (finally!) */
- TIPC_SKB_CB(buf)->handle = msg_data(msg);
+ TIPC_SKB_CB(buf)->handle = 0;
atomic_inc(&tipc_queue_size);
__skb_queue_tail(&sk->sk_receive_queue, buf);
@@ -1608,7 +1600,7 @@ restart:
buf = __skb_dequeue(&sk->sk_receive_queue);
if (buf) {
atomic_dec(&tipc_queue_size);
- if (TIPC_SKB_CB(buf)->handle != msg_data(buf_msg(buf))) {
+ if (TIPC_SKB_CB(buf)->handle != 0) {
buf_discard(buf);
goto restart;
}
--
1.7.3.3
^ permalink raw reply related
* [PATCH net-next 02/26] tipc: Correct broadcast link peer info when displaying links
From: Paul Gortmaker @ 2011-03-13 21:33 UTC (permalink / raw)
To: davem; +Cc: netdev, Allan.Stephens, Paul Gortmaker
In-Reply-To: <1300052054-7531-1-git-send-email-paul.gortmaker@windriver.com>
From: Allan Stephens <Allan.Stephens@windriver.com>
Fixes a typo in the calculation of the network address of a node's own
cluster when generating a response to the configuration command that
lists all of the node's links. The correct mask value for a <Z.C.N>
network address uses 1's for the 8-bit zone and 12-bit cluster parts
and 0's for the 12-bit node part.
Signed-off-by: Allan Stephens <Allan.Stephens@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/tipc/node.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index e4dba1d..d040d47 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -470,7 +470,7 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
/* Add TLV for broadcast link */
- link_info.dest = htonl(tipc_own_addr & 0xfffff00);
+ link_info.dest = htonl(tipc_own_addr & 0xfffff000);
link_info.up = htonl(1);
strlcpy(link_info.str, tipc_bclink_name, TIPC_MAX_LINK_NAME);
tipc_cfg_append_tlv(buf, TIPC_TLV_LINK_INFO, &link_info, sizeof(link_info));
--
1.7.3.3
^ permalink raw reply related
* [PATCH net-next 03/26] tipc: Add network address mask helper routines
From: Paul Gortmaker @ 2011-03-13 21:33 UTC (permalink / raw)
To: davem; +Cc: netdev, Allan.Stephens, Paul Gortmaker
In-Reply-To: <1300052054-7531-1-git-send-email-paul.gortmaker@windriver.com>
From: Allan Stephens <Allan.Stephens@windriver.com>
Introduces a pair of helper routines that convert the network address
for a TIPC node into the network address for its cluster or zone.
This is a cosmetic change designed to avoid future errors caused by
the incorrect use of address bitmasks, and does not alter the existing
operation of TIPC.
Signed-off-by: Allan Stephens <Allan.Stephens@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/tipc/addr.c | 4 ++--
net/tipc/addr.h | 17 +++++++++++++----
net/tipc/node.c | 2 +-
3 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index 88463d9..087e399 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -81,9 +81,9 @@ int tipc_in_scope(u32 domain, u32 addr)
{
if (!domain || (domain == addr))
return 1;
- if (domain == (addr & 0xfffff000u)) /* domain <Z.C.0> */
+ if (domain == tipc_cluster_mask(addr)) /* domain <Z.C.0> */
return 1;
- if (domain == (addr & 0xff000000u)) /* domain <Z.0.0> */
+ if (domain == tipc_zone_mask(addr)) /* domain <Z.0.0> */
return 1;
return 0;
}
diff --git a/net/tipc/addr.h b/net/tipc/addr.h
index 2490fad..8971aba 100644
--- a/net/tipc/addr.h
+++ b/net/tipc/addr.h
@@ -37,6 +37,16 @@
#ifndef _TIPC_ADDR_H
#define _TIPC_ADDR_H
+static inline u32 tipc_zone_mask(u32 addr)
+{
+ return addr & 0xff000000u;
+}
+
+static inline u32 tipc_cluster_mask(u32 addr)
+{
+ return addr & 0xfffff000u;
+}
+
static inline int in_own_cluster(u32 addr)
{
return !((addr ^ tipc_own_addr) >> 12);
@@ -49,14 +59,13 @@ static inline int in_own_cluster(u32 addr)
* after a network hop.
*/
-static inline int addr_domain(int sc)
+static inline u32 addr_domain(u32 sc)
{
if (likely(sc == TIPC_NODE_SCOPE))
return tipc_own_addr;
if (sc == TIPC_CLUSTER_SCOPE)
- return tipc_addr(tipc_zone(tipc_own_addr),
- tipc_cluster(tipc_own_addr), 0);
- return tipc_addr(tipc_zone(tipc_own_addr), 0, 0);
+ return tipc_cluster_mask(tipc_own_addr);
+ return tipc_zone_mask(tipc_own_addr);
}
int tipc_addr_domain_valid(u32);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index d040d47..14f98c8 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -470,7 +470,7 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
/* Add TLV for broadcast link */
- link_info.dest = htonl(tipc_own_addr & 0xfffff000);
+ link_info.dest = htonl(tipc_cluster_mask(tipc_own_addr));
link_info.up = htonl(1);
strlcpy(link_info.str, tipc_bclink_name, TIPC_MAX_LINK_NAME);
tipc_cfg_append_tlv(buf, TIPC_TLV_LINK_INFO, &link_info, sizeof(link_info));
--
1.7.3.3
^ permalink raw reply related
* [PATCH net-next 04/26] tipc: Prevent null pointer error when removing a node subscription
From: Paul Gortmaker @ 2011-03-13 21:33 UTC (permalink / raw)
To: davem; +Cc: netdev, Allan.Stephens, Paul Gortmaker
In-Reply-To: <1300052054-7531-1-git-send-email-paul.gortmaker@windriver.com>
From: Allan Stephens <Allan.Stephens@windriver.com>
Prevents a null pointer dereference from occurring if a node subscription
is triggered at the same time that the subscribing port or publication is
terminating the subscription. The problem arises if the triggering routine
asynchronously activates and deregisters the node subscription while
deregistration is already underway -- the deregistration routine may find
that the pointer it has just verified to be non-NULL is now NULL.
To avoid this race condition the triggering routine now simply marks the
node subscription as defunct (to prevent it from re-activating)
instead of deregistering it. The subscription is now both deregistered
and destroyed only when the subscribing port or publication code terminates
the node subscription.
Signed-off-by: Allan Stephens <Allan.Stephens@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/tipc/name_distr.c | 5 +++--
net/tipc/node.c | 13 +++++++------
2 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 483c226..1d4a18a 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -2,7 +2,7 @@
* net/tipc/name_distr.c: TIPC name distribution code
*
* Copyright (c) 2000-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005, 2010-2011, Wind River Systems
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -221,7 +221,6 @@ exit:
* In rare cases the link may have come back up again when this
* function is called, and we have two items representing the same
* publication. Nudge this item's key to distinguish it from the other.
- * (Note: Publication's node subscription is already unsubscribed.)
*/
static void node_is_down(struct publication *publ)
@@ -232,6 +231,8 @@ static void node_is_down(struct publication *publ)
publ->key += 1222345;
p = tipc_nametbl_remove_publ(publ->type, publ->lower,
publ->node, publ->ref, publ->key);
+ if (p)
+ tipc_nodesub_unsubscribe(&p->subscr);
write_unlock_bh(&tipc_nametbl_lock);
if (p != publ) {
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 14f98c8..8926caa 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -327,7 +327,7 @@ static void node_cleanup_finished(unsigned long node_addr)
static void node_lost_contact(struct tipc_node *n_ptr)
{
- struct tipc_node_subscr *ns, *tns;
+ struct tipc_node_subscr *ns;
char addr_string[16];
u32 i;
@@ -365,11 +365,12 @@ static void node_lost_contact(struct tipc_node *n_ptr)
}
/* Notify subscribers */
- list_for_each_entry_safe(ns, tns, &n_ptr->nsub, nodesub_list) {
- ns->node = NULL;
- list_del_init(&ns->nodesub_list);
- tipc_k_signal((Handler)ns->handle_node_down,
- (unsigned long)ns->usr_handle);
+ list_for_each_entry(ns, &n_ptr->nsub, nodesub_list) {
+ if (ns->handle_node_down) {
+ tipc_k_signal((Handler)ns->handle_node_down,
+ (unsigned long)ns->usr_handle);
+ ns->handle_node_down = NULL;
+ }
}
/* Prevent re-contact with node until all cleanup is done */
--
1.7.3.3
^ permalink raw reply related
* [PATCH net-next 05/26] tipc: Cosmetic changes to node subscription code
From: Paul Gortmaker @ 2011-03-13 21:33 UTC (permalink / raw)
To: davem; +Cc: netdev, Allan.Stephens, Paul Gortmaker
In-Reply-To: <1300052054-7531-1-git-send-email-paul.gortmaker@windriver.com>
From: Allan Stephens <Allan.Stephens@windriver.com>
Relocates the code that notifies users of node subscriptions so that
it is adjacent to the rest of the routines that implement TIPC's node
subscription capability. Renames the name table routine that is
invoked by a node subscription to better reflect its purpose and to
be consistent with other, similar name table routines.
These changes are cosmetic in nature, and do not alter the behavior
of TIPC.
Signed-off-by: Allan Stephens <Allan.Stephens@windriver.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
---
net/tipc/name_distr.c | 7 ++++---
net/tipc/node.c | 9 +--------
net/tipc/node_subscr.c | 21 ++++++++++++++++++++-
net/tipc/node_subscr.h | 3 ++-
4 files changed, 27 insertions(+), 13 deletions(-)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 1d4a18a..d58dae7 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -214,7 +214,7 @@ exit:
}
/**
- * node_is_down - remove publication associated with a failed node
+ * named_purge_publ - remove publication associated with a failed node
*
* Invoked for each publication issued by a newly failed node.
* Removes publication structure from name table & deletes it.
@@ -223,7 +223,7 @@ exit:
* publication. Nudge this item's key to distinguish it from the other.
*/
-static void node_is_down(struct publication *publ)
+static void named_purge_publ(struct publication *publ)
{
struct publication *p;
@@ -269,7 +269,8 @@ void tipc_named_recv(struct sk_buff *buf)
tipc_nodesub_subscribe(&publ->subscr,
msg_orignode(msg),
publ,
- (net_ev_handler)node_is_down);
+ (net_ev_handler)
+ named_purge_publ);
}
} else if (msg_type(msg) == WITHDRAWAL) {
publ = tipc_nametbl_remove_publ(ntohl(item->type),
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 8926caa..713ab5d 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -327,7 +327,6 @@ static void node_cleanup_finished(unsigned long node_addr)
static void node_lost_contact(struct tipc_node *n_ptr)
{
- struct tipc_node_subscr *ns;
char addr_string[16];
u32 i;
@@ -365,13 +364,7 @@ static void node_lost_contact(struct tipc_node *n_ptr)
}
/* Notify subscribers */
- list_for_each_entry(ns, &n_ptr->nsub, nodesub_list) {
- if (ns->handle_node_down) {
- tipc_k_signal((Handler)ns->handle_node_down,
- (unsigned long)ns->usr_handle);
- ns->handle_node_down = NULL;
- }
- }
+ tipc_nodesub_notify(n_ptr);
/* Prevent re-contact with node until all cleanup is done */
diff --git a/net/tipc/node_subscr.c b/net/tipc/node_subscr.c
index 018a553..c3c2815 100644
--- a/net/tipc/node_subscr.c
+++ b/net/tipc/node_subscr.c
@@ -2,7 +2,7 @@
* net/tipc/node_subscr.c: TIPC "node down" subscription handling
*
* Copyright (c) 1995-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005, 2010-2011, Wind River Systems
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -76,3 +76,22 @@ void tipc_nodesub_unsubscribe(struct tipc_node_subscr *node_sub)
list_del_init(&node_sub->nodesub_list);
tipc_node_unlock(node_sub->node);
}
+
+/**
+ * tipc_nodesub_notify - notify subscribers that a node is unreachable
+ *
+ * Note: node is locked by caller
+ */
+
+void tipc_nodesub_notify(struct tipc_node *node)
+{
+ struct tipc_node_subscr *ns;
+
+ list_for_each_entry(ns, &node->nsub, nodesub_list) {
+ if (ns->handle_node_down) {
+ tipc_k_signal((Handler)ns->handle_node_down,
+ (unsigned long)ns->usr_handle);
+ ns->handle_node_down = NULL;
+ }
+ }
+}
diff --git a/net/tipc/node_subscr.h b/net/tipc/node_subscr.h
index 006ed73..4bc2ca0 100644
--- a/net/tipc/node_subscr.h
+++ b/net/tipc/node_subscr.h
@@ -2,7 +2,7 @@
* net/tipc/node_subscr.h: Include file for TIPC "node down" subscription handling
*
* Copyright (c) 1995-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005, 2010-2011, Wind River Systems
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -59,5 +59,6 @@ struct tipc_node_subscr {
void tipc_nodesub_subscribe(struct tipc_node_subscr *node_sub, u32 addr,
void *usr_handle, net_ev_handler handle_down);
void tipc_nodesub_unsubscribe(struct tipc_node_subscr *node_sub);
+void tipc_nodesub_notify(struct tipc_node *node);
#endif
--
1.7.3.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox