* Re: Comment on nf_queue NF_STOLEN patch
From: Jim Sansing @ 2011-10-18 21:34 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Linux Network Development list
In-Reply-To: <1318973032.19139.5.camel@edumazet-laptop>
Eric Dumazet wrote:
> Le mardi 18 octobre 2011 à 15:08 -0400, Jim Sansing a écrit :
>
>> I have been working on a kernel module that registers with netfilter,
>> and I noticed that a patch was added to nf_queue that changed the
>> handling of return code NF_FILTER from 'do nothing' to 'free the skb'.
>> I'm not sure which kernel version this went in, but the date of the
>> patch is Feb, 19, 2010.
>>
>> Everything I have read about netfilter states that it is up to the
>> netfilter hook to free the skb if NF_STOLEN is returned. The
>> implications of this patch from a hook programming perspective are:
>>
>> 1) If the skb is used after the return from the hook, it must be cloned.
>> 2) The original skb must not be freed.
>>
>> I suggest that a comment be added to include/linux/netfilter.h that says
>> explicitly the skb will be freed if NF_STOLEN is returned.
>>
>
> But its not true. Just read the code.
>
> If you are working on this stuff I recommend you take a look at
> commits :
>
> c6675233f9015d3c0460c8aab53ed9b99d915c64
> (netfilter: nf_queue: reject NF_STOLEN verdicts from userspace)
>
> fad54440438a7c231a6ae347738423cbabc936d9
> (netfilter: avoid double free in nf_reinject)
>
> 64507fdbc29c3a622180378210ecea8659b14e40
> (netfilter: nf_queue: fix NF_STOLEN skb leak)
>
> 3bc38712e3a6e0596ccb6f8299043a826f983701
> ([NETFILTER]: nf_queue: handle NF_STOP and unknown verdicts in
> nf_reinject)
>
>
I see that fad54440438a7c231a6ae347738423cbabc936d9 (netfilter: avoid
double free in nf_reinject) returns the switch case for NF_STOLEN back
to the original state, but I just downloaded 3.0.4, and the skb is still
freed. So for some versions of the kernel, the situation exists.
Hopefully anyone who runs into it will find this thread.
Later . . . Jim
^ permalink raw reply
* Re: [PATCH 9/9] make net/core/scm.c uid comparisons user namespace aware
From: Serge E. Hallyn @ 2011-10-18 23:22 UTC (permalink / raw)
To: Joe Perches
Cc: linux-kernel, ebiederm, akpm, oleg, richard, mikevs, segoon,
gregkh, dhowells, eparis, Serge E. Hallyn, netdev
In-Reply-To: <1318976049.2273.7.camel@Joe-Laptop>
Quoting Joe Perches (joe@perches.com):
> On Tue, 2011-10-18 at 21:54 +0000, Serge Hallyn wrote:
> > From: "Serge E. Hallyn" <serge.hallyn@canonical.com>
>
> Hi Serge.
>
> Just some trivial style notes.
>
> > Currently uids are compared without regard for the user namespace.
> > Fix that to prevent tasks in a different user namespace from
> > wrongly matching on SCM_CREDENTIALS.
> []
> > diff --git a/net/core/scm.c b/net/core/scm.c
>
> > -static __inline__ int scm_check_creds(struct ucred *creds)
> > +static __inline__ bool uidequiv(const struct cred *src, struct ucred *tgt,
> > + struct user_namespace *ns)
>
> Perhaps inline is better than __inline__ and do these
> functions really need to be marked inline at all?
Dunno, I was just sticking with the current style.
> > +{
> > + if (src->user_ns != ns)
> > + goto check_capable;
> > + if (src->uid == tgt->uid || src->euid == tgt->uid ||
> > + src->suid == tgt->uid)
>
> Perhaps this is less prone to typo errors and are a bit
> more readable as:
>
> if (tgt->uid == src->uid ||
> tgt->uid == src->euid ||
> tgt->uid == src->suid)
I do like that better.
thanks,
-serge
^ permalink raw reply
* Re: [RESEND] [PATCH] ll_temac: Add support for ethtool
From: Ben Hutchings @ 2011-10-18 23:29 UTC (permalink / raw)
To: Ricardo Ribalda Delgado
Cc: davem, grant.likely, sfr, u.kleine-koenig, netdev, linux-kernel
In-Reply-To: <1318960501-3544-1-git-send-email-ricardo.ribalda@gmail.com>
On Tue, 2011-10-18 at 19:55 +0200, Ricardo Ribalda Delgado wrote:
> This patch enables the ethtool interface. The implementation is done
> using the libphy helper functions.
All Ethernet drivers have been moved in net-next. This driver is now
under drivers/net/ethernet/xilinx.
> Reviewed-by: Grant Likely <grant.likely@secretlab.ca>
> Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
> ---
> drivers/net/ll_temac_main.c | 27 +++++++++++++++++++++++++++
> 1 files changed, 27 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
> index 728fe41..91a9804 100644
> --- a/drivers/net/ll_temac_main.c
> +++ b/drivers/net/ll_temac_main.c
> @@ -957,6 +957,32 @@ static const struct attribute_group temac_attr_group = {
> .attrs = temac_device_attrs,
> };
>
> +/* ethtool support */
> +static int temac_get_settings(struct net_device *ndev, struct ethtool_cmd *cmd)
> +{
> + struct temac_local *lp = netdev_priv(ndev);
> + return phy_ethtool_gset(lp->phy_dev, cmd);
> +}
> +
> +static int temac_set_settings(struct net_device *ndev, struct ethtool_cmd *cmd)
> +{
> + struct temac_local *lp = netdev_priv(ndev);
> + return phy_ethtool_sset(lp->phy_dev, cmd);
> +}
> +
> +static int temac_nway_reset(struct net_device *ndev)
> +{
> + struct temac_local *lp = netdev_priv(ndev);
> + return phy_start_aneg(lp->phy_dev);
> +}
> +
> +static const struct ethtool_ops temac_ethtool_ops = {
> + .get_settings = temac_get_settings,
> + .set_settings = temac_set_settings,
> + .nway_reset = temac_nway_reset,
> + .get_link = ethtool_op_get_link,
> +};
> +
> static int __devinit temac_of_probe(struct platform_device *op)
> {
> struct device_node *np;
> @@ -978,6 +1004,7 @@ static int __devinit temac_of_probe(struct platform_device *op)
> ndev->flags &= ~IFF_MULTICAST; /* clear multicast */
> ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
> ndev->netdev_ops = &temac_netdev_ops;
> + ndev->ethtool_ops= &temac_ethtool_ops;
Missing space before '='.
Ben.
> #if 0
> ndev->features |= NETIF_F_IP_CSUM; /* Can checksum TCP/UDP over IPv4. */
> ndev->features |= NETIF_F_HW_CSUM; /* Can checksum all the packets. */
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: [PATCH] route:ip_rt_frag_needed always return unzero
From: Gao feng @ 2011-10-19 1:34 UTC (permalink / raw)
To: Eric Dumazet; +Cc: davem, kuznet, jmorris, netdev
In-Reply-To: <1318929797.2657.21.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
2011.10.18 17:23, Eric Dumazet wrote:
> Le mardi 18 octobre 2011 à 15:04 +0800, Gao feng a écrit :
>> int function ip_rt_frag_need,if peer is null,
>> there is no need to do ipprot->err_handler.
>> I am right?
>>
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>> ---
>> net/ipv4/route.c | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
>> index 075212e..6cde0fa 100644
>> --- a/net/ipv4/route.c
>> +++ b/net/ipv4/route.c
>> @@ -1574,7 +1574,7 @@ unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
>>
>> atomic_inc(&__rt_peer_genid);
>> }
>> - return est_mtu ? : new_mtu;
>> + return est_mtu;
>> }
>>
>> static void check_peer_pmtu(struct dst_entry *dst, struct inet_peer *peer)
>
> No idea why you want this, your changelog is a bit cryptic :)
>
> Wont this bypass the raw_icmp_error(skb, protocol, info);
> call in icmp_unreach() as well ?
>
>
thanks Eric!
I mean that the pmtu is update by inet_peer->pmtu_learned as I know.
so in function ip_rt_frag_needed,
if inet_peer is null or someting else make the setting of inet_peer->pmtu_learned failed.
there is no need to call function tcp_v4_err.
the call stack is
icmp_unreach
|
|--->ip_rt_frag_needed(fill inet_peer)
|
|--->raw_icmp_error()
|
|--->ipprot->err_handler(tcp_v4_err or something else)
|
|--->tcp_v4_err(frag need icmp is triggered by tcp packet)
|
|--->do_pmtu_discovery
(in this function both __sk_dst_check or dst->ops->update_pmtu
need struct inet_peer to update pmtu)
so,I think when set inet_peer->pmtu_learned failed,
in func icmp_unreach we should goto out immediately.
And it's confuse me that why func ping_err and udp_err not update the pmtu?
What I miss?
^ permalink raw reply
* Re: [PATCH net] vlan:make mtu of vlan equal to physical dev
From: WeipingPan @ 2011-10-19 2:06 UTC (permalink / raw)
To: herbert; +Cc: open list:NETWORKING [GENERAL]
In-Reply-To: <bc33a6142ce48b71b9c232a9154ed76f6048f0cb.1318068629.git.panweiping3@gmail.com>
Hi, Herbert,
What do you think of this patch ?
thanks
Weiping Pan
On 10/08/2011 06:12 PM, Weiping Pan wrote:
> Default mtu of vlan device is the same with mtu of physical device,
> for example 1500, but when change physics mtu to 1600,
> VLAN device's mtu is still 1500.
> Certainly, you can change vlan device's mtu to 1600 manually,
> but I think when you change physics device's mtu, VLAN's mtu should be changed
> automatically instead of by manually.
>
> Steps to Reproduce:
> 1.vconfig add eth4 3
> 2.ifconfig eth4 mtu 1600
> 3.check mtu on eth4.3
>
> And what's worse is that if you decrease mtu of pyhsical device,
> and when you want to increase it, the mtu of vlan device won't be changed.
>
> Steps to Reproduce:
> 1.vconfig add eth4 3
> 2.ifconfig eth4 mtu 100
> 3.ifconfig eth4 mtu 1500
> 4.the mtu of eth4.3 is still 100
>
> This bug is reported by Liang Zheng(lzheng@redhat.com).
>
> Signed-off-by: Weiping Pan<panweiping3@gmail.com>
> ---
> net/8021q/vlan.c | 3 ---
> 1 files changed, 0 insertions(+), 3 deletions(-)
>
> diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
> index 8970ba1..f6072b4 100644
> --- a/net/8021q/vlan.c
> +++ b/net/8021q/vlan.c
> @@ -417,9 +417,6 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
> if (!vlandev)
> continue;
>
> - if (vlandev->mtu<= dev->mtu)
> - continue;
> -
> dev_set_mtu(vlandev, dev->mtu);
> }
> break;
^ permalink raw reply
* [PATCH 9/9] make net/core/scm.c uid comparisons user namespace aware (v2)
From: Serge E. Hallyn @ 2011-10-19 2:25 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: Joe Perches, linux-kernel, ebiederm, akpm, oleg, richard, mikevs,
segoon, gregkh, dhowells, eparis, netdev
In-Reply-To: <20111018232242.GA22950@hallyn.com>
(Thanks for the suggestions, Joe.)
Currently uids are compared without regard for the user namespace.
Fix that to prevent tasks in a different user namespace from
wrongly matching on SCM_CREDENTIALS.
In the past, either your uids had to match, or you had to have
CAP_SETXID. In a namespaced world, you must either (both be in the
same user namespace and have your uids match), or you must have
CAP_SETXID targeted at the other user namespace. The latter can
happen for instance if uid 500 created a new user namespace and
now interacts with uid 0 in it.
Changelog: Oct 18:
Per Joe Perches: don't mark uidequiv and gidequiv fns inline
(let the compiler do that if appropriate), and change the flow
of id comparisons to make it clearer.
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Joe Perches <joe@perches.com>
---
net/core/scm.c | 43 ++++++++++++++++++++++++++++++++++++-------
1 files changed, 36 insertions(+), 7 deletions(-)
diff --git a/net/core/scm.c b/net/core/scm.c
index 811b53f..2261607 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -43,17 +43,46 @@
* setu(g)id.
*/
-static __inline__ int scm_check_creds(struct ucred *creds)
+static bool uidequiv(const struct cred *src, struct ucred *tgt,
+ struct user_namespace *ns)
+{
+ if (src->user_ns != ns)
+ goto check_capable;
+ if (tgt->uid == src->uid ||
+ tgt->uid == src->euid ||
+ tgt->uid == src->suid)
+ return true;
+check_capable:
+ if (ns_capable(ns, CAP_SETUID))
+ return true;
+ return false;
+}
+
+static bool gidequiv(const struct cred *src, struct ucred *tgt,
+ struct user_namespace *ns)
+{
+ if (src->user_ns != ns)
+ goto check_capable;
+ if (tgt->gid == src->gid ||
+ tgt->gid == src->egid ||
+ tgt->gid == src->sgid)
+ return true;
+check_capable:
+ if (ns_capable(ns, CAP_SETGID))
+ return true;
+ return false;
+}
+
+static int scm_check_creds(struct ucred *creds, struct socket *sock)
{
const struct cred *cred = current_cred();
+ struct user_namespace *ns = sock_net(sock->sk)->user_ns;
- if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
- ((creds->uid == cred->uid || creds->uid == cred->euid ||
- creds->uid == cred->suid) || capable(CAP_SETUID)) &&
- ((creds->gid == cred->gid || creds->gid == cred->egid ||
- creds->gid == cred->sgid) || capable(CAP_SETGID))) {
+ if ((creds->pid == task_tgid_vnr(current) || ns_capable(ns, CAP_SYS_ADMIN)) &&
+ uidequiv(cred, creds, ns) && gidequiv(cred, creds, ns)) {
return 0;
}
+
return -EPERM;
}
@@ -169,7 +198,7 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
goto error;
memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
- err = scm_check_creds(&p->creds);
+ err = scm_check_creds(&p->creds, sock);
if (err)
goto error;
--
1.7.5.4
^ permalink raw reply related
* Re: [PATCH] route:ip_rt_frag_needed always return unzero
From: Gao feng @ 2011-10-19 2:33 UTC (permalink / raw)
To: Eric Dumazet; +Cc: davem, kuznet, jmorris, netdev
In-Reply-To: <4E9E2929.7070701@cn.fujitsu.com>
于 2011年10月19日 09:34, Gao feng 写道:
> 2011.10.18 17:23, Eric Dumazet wrote:
>> Le mardi 18 octobre 2011 à 15:04 +0800, Gao feng a écrit :
>>> int function ip_rt_frag_need,if peer is null,
>>> there is no need to do ipprot->err_handler.
>>> I am right?
>>>
>>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>>> ---
>>> net/ipv4/route.c | 2 +-
>>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>>
>>> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
>>> index 075212e..6cde0fa 100644
>>> --- a/net/ipv4/route.c
>>> +++ b/net/ipv4/route.c
>>> @@ -1574,7 +1574,7 @@ unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
>>>
>>> atomic_inc(&__rt_peer_genid);
>>> }
>>> - return est_mtu ? : new_mtu;
>>> + return est_mtu;
>>> }
>>>
>>> static void check_peer_pmtu(struct dst_entry *dst, struct inet_peer *peer)
>>
>> No idea why you want this, your changelog is a bit cryptic :)
>>
>> Wont this bypass the raw_icmp_error(skb, protocol, info);
>> call in icmp_unreach() as well ?
>>
>>
>
> thanks Eric!
>
> I mean that the pmtu is update by inet_peer->pmtu_learned as I know.
> so in function ip_rt_frag_needed,
> if inet_peer is null or someting else make the setting of inet_peer->pmtu_learned failed.
> there is no need to call function tcp_v4_err.
>
> the call stack is
> icmp_unreach
> |
> |--->ip_rt_frag_needed(fill inet_peer)
> |
> |--->raw_icmp_error()
> |
> |--->ipprot->err_handler(tcp_v4_err or something else)
> |
> |--->tcp_v4_err(frag need icmp is triggered by tcp packet)
> |
> |--->do_pmtu_discovery
> (in this function both __sk_dst_check or dst->ops->update_pmtu
> need struct inet_peer to update pmtu)
>
> so,I think when set inet_peer->pmtu_learned failed,
> in func icmp_unreach we should goto out immediately.
>
> And it's confuse me that why func ping_err and udp_err not update the pmtu?
> What I miss?
> --
And move atomic_inc(&__rt_peer_genid) just like func ip_rt_update_pmtu?
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6cde0fa..3e1aa5c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1568,11 +1568,12 @@ unsigned short ip_rt_frag_needed(struct net *net, const
est_mtu = mtu;
peer->pmtu_learned = mtu;
peer->pmtu_expires = pmtu_expires;
+
+ atomic_inc(&__rt_peer_genid);
}
inet_putpeer(peer);
- atomic_inc(&__rt_peer_genid);
}
return est_mtu;
}
^ permalink raw reply related
* Re: [PATCH net] vlan:make mtu of vlan equal to physical dev
From: Ben Greear @ 2011-10-19 2:51 UTC (permalink / raw)
To: WeipingPan; +Cc: herbert, open list:NETWORKING [GENERAL]
In-Reply-To: <4E9E30B8.5030904@gmail.com>
On 10/18/2011 07:06 PM, WeipingPan wrote:
> Hi, Herbert,
>
> What do you think of this patch ?
>
> thanks
> Weiping Pan
> On 10/08/2011 06:12 PM, Weiping Pan wrote:
>> Default mtu of vlan device is the same with mtu of physical device,
>> for example 1500, but when change physics mtu to 1600,
>> VLAN device's mtu is still 1500.
>> Certainly, you can change vlan device's mtu to 1600 manually,
>> but I think when you change physics device's mtu, VLAN's mtu should be changed
>> automatically instead of by manually.
I don't like the idea. It's perfectly valid to have the physical dev with 9000 MTU
and have vlans with 1500 MTU.
>> Steps to Reproduce:
>> 1.vconfig add eth4 3
>> 2.ifconfig eth4 mtu 1600
>> 3.check mtu on eth4.3
>>
>> And what's worse is that if you decrease mtu of pyhsical device,
>> and when you want to increase it, the mtu of vlan device won't be changed.
That *might* be worth fixing, but even so, some NICs might handle that
just fine, so my opinion is that this should not change either.
Thanks,
Ben
>>
>> Steps to Reproduce:
>> 1.vconfig add eth4 3
>> 2.ifconfig eth4 mtu 100
>> 3.ifconfig eth4 mtu 1500
>> 4.the mtu of eth4.3 is still 100
>>
>> This bug is reported by Liang Zheng(lzheng@redhat.com).
>>
>> Signed-off-by: Weiping Pan<panweiping3@gmail.com>
>> ---
>> net/8021q/vlan.c | 3 ---
>> 1 files changed, 0 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
>> index 8970ba1..f6072b4 100644
>> --- a/net/8021q/vlan.c
>> +++ b/net/8021q/vlan.c
>> @@ -417,9 +417,6 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
>> if (!vlandev)
>> continue;
>>
>> - if (vlandev->mtu<= dev->mtu)
>> - continue;
>> -
>> dev_set_mtu(vlandev, dev->mtu);
>> }
>> break;
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply
* Re: [PATCH net-next] macvlan: handle fragmented multicast frames
From: David Miller @ 2011-10-19 3:22 UTC (permalink / raw)
To: eric.dumazet; +Cc: greearb, netdev
In-Reply-To: <1317932911.3457.31.camel@edumazet-laptop>
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Thu, 06 Oct 2011 22:28:31 +0200
> [PATCH net-next] macvlan: handle fragmented multicast frames
>
> Fragmented multicast frames are delivered to a single macvlan port,
> because ip defrag logic considers other samples are redundant.
>
> Implement a defrag step before trying to send the multicast frame.
>
> Reported-by: Ben Greear <greearb@candelatech.com>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied to net-next, thanks.
^ permalink raw reply
* Re: [PATCH] bridge: fix hang on removal of bridge via netlink
From: David Miller @ 2011-10-19 3:24 UTC (permalink / raw)
To: sri; +Cc: shemminger, netdev
In-Reply-To: <1317942169.6433.17.camel@w-sridhar.beaverton.ibm.com>
From: Sridhar Samudrala <sri@us.ibm.com>
Date: Thu, 06 Oct 2011 16:02:49 -0700
> On Thu, 2011-10-06 at 14:19 -0700, Stephen Hemminger wrote:
>> Need to cleanup bridge device timers and ports when being bridge
>> device is being removed via netlink.
>>
>> This fixes the problem of observed when doing:
>> ip link add br0 type bridge
>> ip link set dev eth1 master br0
>> ip link set br0 up
>> ip link del br0
>>
>> which would cause br0 to hang in unregister_netdev because
>> of leftover reference count.
>>
>> Reported-by: Sridhar Samudrala <sri@us.ibm.com>
>> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
>
> Acked-by: Sridhar Samudrala <sri@us.ibm.com>
Applied to 'net' and queued up for -stable, thanks.
^ permalink raw reply
* Re: [PATCH] pch_gbe: compilation warning in pch_gbe_setup_rctl() fixed
From: David Miller @ 2011-10-19 3:28 UTC (permalink / raw)
To: vvs; +Cc: netdev, toshiharu-linux, vvs
In-Reply-To: <1317974359-20548-1-git-send-email-vvs@parallels.com>
From: Vasily Averin <vvs@parallels.com>
Date: Fri, 7 Oct 2011 11:59:19 +0400
> From: Vasily Averin <vvs@sw.ru>
>
> compilation warning fixed
> drivers/net/pch_gbe/pch_gbe_main.c: In function ‘pch_gbe_setup_rctl’:
> drivers/net/pch_gbe/pch_gbe_main.c:701:21: warning: unused variable ‘netdev’
>
> Signed-off-by: Vasily Averin <vvs@sw.ru>
This patch is not appropriate for the 'net' tree, and in the
'net-next' tree not only is the driver in a completely different
directory but also this warning is already fixed.
^ permalink raw reply
* Re: [PATCH] l2tp: fix a potential skb leak in l2tp_xmit_skb()
From: David Miller @ 2011-10-19 3:32 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev
In-Reply-To: <1318001746.3207.21.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Fri, 07 Oct 2011 17:35:46 +0200
> l2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error.
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied and queued up for -stable, thanks Eric.
^ permalink raw reply
* Re: [PATCH net-next] l2tp: give proper headroom in pppol2tp_xmit()
From: David Miller @ 2011-10-19 3:34 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev
In-Reply-To: <1318002357.3207.28.camel@edumazet-HP-Compaq-6005-Pro-SFF-PC>
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Fri, 07 Oct 2011 17:45:57 +0200
> pppol2tp_xmit() calls skb_cow_head(skb, 2) before calling
> l2tp_xmit_skb()
>
> Then l2tp_xmit_skb() calls again skb_cow_head(skb, large_headroom)
>
> This patchs changes the first skb_cow_head() call to supply the needed
> headroom to make sure at most one (expensive) pskb_expand_head() is
> done.
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> ---
> Maybe we should add a counter to help diagnose too many
> pskb_expand_head() calls...
Applied.
I think it's the kind of event that deserves a tracepoint, this way one
could use perf to notice and diagnose such problems.
^ permalink raw reply
* Re: [PATCH] bluetooth: Properly clone LSM attributes to newly created child connections
From: David Miller @ 2011-10-19 3:36 UTC (permalink / raw)
To: pmoore; +Cc: netdev, linux-security-module, selinux
In-Reply-To: <20111007194059.12345.13398.stgit@sifl>
From: Paul Moore <pmoore@redhat.com>
Date: Fri, 07 Oct 2011 15:40:59 -0400
> The Bluetooth stack has internal connection handlers for all of the various
> Bluetooth protocols, and unfortunately, they are currently lacking the LSM
> hooks found in the core network stack's connection handlers. I say
> unfortunately, because this can cause problems for users who have have an
> LSM enabled and are using certain Bluetooth devices. See one problem
> report below:
>
> * http://bugzilla.redhat.com/show_bug.cgi?id=741703
>
> In order to keep things simple at this point in time, this patch fixes the
> problem by cloning the parent socket's LSM attributes to the newly created
> child socket. If we decide we need a more elaborate LSM marking mechanism
> for Bluetooth (I somewhat doubt this) we can always revisit this decision
> in the future.
>
> Reported-by: James M. Cape <jcape@ignore-your.tv>
> Signed-off-by: Paul Moore <pmoore@redhat.com>
Applied, thanks!
^ permalink raw reply
* Re: [net-next v2] cs89x0: Move the driver into the Cirrus dir
From: David Miller @ 2011-10-19 3:42 UTC (permalink / raw)
To: jeffrey.t.kirsher; +Cc: netdev, gospo, sassmann, nelson, akpm
In-Reply-To: <1318061264-25310-1-git-send-email-jeffrey.t.kirsher@intel.com>
From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Date: Sat, 8 Oct 2011 01:07:44 -0700
> The cs89x0 driver was initial placed in the apple/ when it
> should have been placed in the cirrus/. This resolves the
> issue by moving the dirver and fixing up the respective
> Kconfig(s) and Makefile(s).
>
> Thanks to Sascha for reporting the issue.
>
> -v2 Fix a config error that was introduced with v1 by removing
> the dependency on MACE for NET_VENDOR_APPLE.
>
> CC: Russell Nelson <nelson@crynwr.com>
> CC: Andrew Morton <akpm@linux-foundation.org>
> Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Applied, thanks.
^ permalink raw reply
* Re: [net-next PATCH] net: allow vlan traffic to be received under bond
From: David Miller @ 2011-10-19 3:47 UTC (permalink / raw)
To: jesse; +Cc: john.r.fastabend, hans.schillstrom, jpirko, mbizon, netdev, fubar
In-Reply-To: <CAEP_g=9dk_ERdnw4Hw_8RO8Z23E1g2Q9G=AxPkiaVhwbHvo47A@mail.gmail.com>
From: Jesse Gross <jesse@nicira.com>
Date: Thu, 13 Oct 2011 17:22:02 -0700
> Actually, for most of 2.6.x the behavior was somewhat
> non-deterministic since it depended on kernel version and the NIC. As
> a result, I think we can safely say that this wasn't a particularly
> firm interface that we have to be wedded to. Based on overwhelming
> feedback, I think the interface in this patch is the preferred one and
> what we should stabilize on.
Agreed, and I've applied this patch to net-next, thanks everyone!
^ permalink raw reply
* Re: [PATCH net-next] net: add skb frag size accessors
From: David Miller @ 2011-10-19 3:49 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev
In-Reply-To: <1318279267.2567.19.camel@edumazet-laptop>
It seems that enough has changed that this patch no longer applies,
I'm sorry for taking so long to get to it as that is part of the
reason this situation was created.
I'd really appreciate it if you'd respin this patch, thanks1
^ permalink raw reply
* Re: [PATCH] route:ip_rt_frag_needed always return unzero
From: Eric Dumazet @ 2011-10-19 3:49 UTC (permalink / raw)
To: Gao feng; +Cc: davem, kuznet, jmorris, netdev
In-Reply-To: <4E9E2929.7070701@cn.fujitsu.com>
Le mercredi 19 octobre 2011 à 09:34 +0800, Gao feng a écrit :
> 2011.10.18 17:23, Eric Dumazet wrote:
> > Le mardi 18 octobre 2011 à 15:04 +0800, Gao feng a écrit :
> >> int function ip_rt_frag_need,if peer is null,
> >> there is no need to do ipprot->err_handler.
> >> I am right?
> >>
> >> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> >> ---
> >> net/ipv4/route.c | 2 +-
> >> 1 files changed, 1 insertions(+), 1 deletions(-)
> >>
> >> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> >> index 075212e..6cde0fa 100644
> >> --- a/net/ipv4/route.c
> >> +++ b/net/ipv4/route.c
> >> @@ -1574,7 +1574,7 @@ unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
> >>
> >> atomic_inc(&__rt_peer_genid);
> >> }
> >> - return est_mtu ? : new_mtu;
> >> + return est_mtu;
> >> }
> >>
> >> static void check_peer_pmtu(struct dst_entry *dst, struct inet_peer *peer)
> >
> > No idea why you want this, your changelog is a bit cryptic :)
> >
> > Wont this bypass the raw_icmp_error(skb, protocol, info);
> > call in icmp_unreach() as well ?
> >
> >
>
> thanks Eric!
>
> I mean that the pmtu is update by inet_peer->pmtu_learned as I know.
> so in function ip_rt_frag_needed,
> if inet_peer is null or someting else make the setting of inet_peer->pmtu_learned failed.
> there is no need to call function tcp_v4_err.
>
> the call stack is
> icmp_unreach
> |
> |--->ip_rt_frag_needed(fill inet_peer)
> |
> |--->raw_icmp_error()
> |
> |--->ipprot->err_handler(tcp_v4_err or something else)
> |
> |--->tcp_v4_err(frag need icmp is triggered by tcp packet)
> |
> |--->do_pmtu_discovery
> (in this function both __sk_dst_check or dst->ops->update_pmtu
> need struct inet_peer to update pmtu)
>
> so,I think when set inet_peer->pmtu_learned failed,
> in func icmp_unreach we should goto out immediately.
>
> And it's confuse me that why func ping_err and udp_err not update the pmtu?
> What I miss?
You dont answer my question : After your patch, we now dont call
raw_icmp_error() anymore. Why is is valid ?
Not finding/create inet_peer is very unlikely : This occurs only under
high stress and out of memory condition. Is it really happening on your
machines ?
^ permalink raw reply
* Re: [net-next] net/phy: extra delay only for RGMII interfaces for IC+ IP 1001
From: David Miller @ 2011-10-19 3:50 UTC (permalink / raw)
To: peppe.cavallaro; +Cc: netdev
In-Reply-To: <1318318676-4493-1-git-send-email-peppe.cavallaro@st.com>
From: Giuseppe CAVALLARO <peppe.cavallaro@st.com>
Date: Tue, 11 Oct 2011 09:37:56 +0200
> The extra delay of 2ns to adjust RX clock phase is actually needed
> in RGMII mode. Tested on the HDK7108 (STx7108c2).
>
> Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Applied, thank you.
^ permalink raw reply
* Re: [PATCH net-next] ipv6: Remove superfluous NULL pointer check in ipv6_local_rxpmtu
From: David Miller @ 2011-10-19 3:51 UTC (permalink / raw)
To: steffen.klassert; +Cc: netdev
In-Reply-To: <20111011120102.GL1830@secunet.com>
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Tue, 11 Oct 2011 14:01:02 +0200
> The pointer to mtu_info is taken from the common buffer
> of the skb, thus it can't be a NULL pointer. This patch
> removes this check on mtu_info.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next] xfrm: Simplify the replay check and advance functions
From: David Miller @ 2011-10-19 3:51 UTC (permalink / raw)
To: steffen.klassert; +Cc: herbert, netdev
In-Reply-To: <20111011115837.GK1830@secunet.com>
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Tue, 11 Oct 2011 13:58:37 +0200
> The replay check and replay advance functions had some code
> duplications. This patch removes the duplications.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Applied.
^ permalink raw reply
* Re: [PATCH 1/2] ipv6: Fix IPsec slowpath fragmentation problem
From: David Miller @ 2011-10-19 3:53 UTC (permalink / raw)
To: steffen.klassert; +Cc: herbert, netdev
In-Reply-To: <20111011114333.GI1830@secunet.com>
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Tue, 11 Oct 2011 13:43:33 +0200
> ip6_append_data() builds packets based on the mtu from dst_mtu(rt->dst.path).
> On IPsec the effective mtu is lower because we need to add the protocol
> headers and trailers later when we do the IPsec transformations. So after
> the IPsec transformations the packet might be too big, which leads to a
> slowpath fragmentation then. This patch fixes this by building the packets
> based on the lower IPsec mtu from dst_mtu(&rt->dst) and adapts the exthdr
> handling to this.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Applied.
^ permalink raw reply
* Re: [PATCH 2/2] xfrm6: Don't call icmpv6_send on local error
From: David Miller @ 2011-10-19 3:53 UTC (permalink / raw)
To: steffen.klassert; +Cc: herbert, netdev
In-Reply-To: <20111011114430.GJ1830@secunet.com>
From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Tue, 11 Oct 2011 13:44:30 +0200
> Calling icmpv6_send() on a local message size error leads to
> an incorrect update of the path mtu. So use xfrm6_local_rxpmtu()
> to notify about the pmtu if the IPV6_DONTFRAG socket option is
> set on an udp or raw socket, according RFC 3542 and use
> ipv6_local_error() otherwise.
>
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Applied.
^ permalink raw reply
* Re: [PATCH v2] netconsole: enable netconsole can make net_device refcnt incorrent
From: David Miller @ 2011-10-19 3:55 UTC (permalink / raw)
To: fbl; +Cc: gaofeng, netdev, eric.dumazet
In-Reply-To: <20111012102344.0b718260@asterix.rh>
From: Flavio Leitner <fbl@redhat.com>
Date: Wed, 12 Oct 2011 10:23:44 -0300
> On Wed, 12 Oct 2011 10:08:11 +0800
> Gao feng <gaofeng@cn.fujitsu.com> wrote:
>
>> There is no check if netconsole is enabled current.
>> so when exec echo 1 > enabled;
>> the reference of net_device will increment always.
>>
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>> ---
>> drivers/net/netconsole.c | 5 +++++
>> 1 files changed, 5 insertions(+), 0 deletions(-)
>
> Looks better, thanks!
> Acked-by: Flavio Leitner <fbl@redhat.com>
Applied, thanks everyone.
^ permalink raw reply
* Re: [PATCH] route:ip_rt_frag_needed always return unzero
From: Eric Dumazet @ 2011-10-19 3:57 UTC (permalink / raw)
To: Gao feng; +Cc: davem, kuznet, jmorris, netdev
In-Reply-To: <4E9E36DC.4050304@cn.fujitsu.com>
Le mercredi 19 octobre 2011 à 10:33 +0800, Gao feng a écrit :
> And move atomic_inc(&__rt_peer_genid) just like func ip_rt_update_pmtu?
>
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 6cde0fa..3e1aa5c 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -1568,11 +1568,12 @@ unsigned short ip_rt_frag_needed(struct net *net, const
> est_mtu = mtu;
> peer->pmtu_learned = mtu;
> peer->pmtu_expires = pmtu_expires;
> +
> + atomic_inc(&__rt_peer_genid);
> }
>
> inet_putpeer(peer);
>
> - atomic_inc(&__rt_peer_genid);
> }
> return est_mtu;
> }
>
This one is fine, please provide a changelog and official submission.
Thanks
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox