* Re: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois
From: Stephen Hemminger @ 2012-10-31 20:48 UTC (permalink / raw)
To: Jesper Dangaard Brouer
Cc: David S. Miller, netdev, Petr Matousek, Eric Dumazet
In-Reply-To: <20121031124318.30915.32293.stgit@dragon>
On Wed, 31 Oct 2012 13:45:32 +0100
Jesper Dangaard Brouer <brouer@redhat.com> wrote:
> Reading TCP stats when using TCP Illinois congestion control algorithm
> can cause a divide by zero kernel oops.
>
> The division by zero occur in tcp_illinois_info() at:
> do_div(t, ca->cnt_rtt);
> where ca->cnt_rtt can become zero (when rtt_reset is called)
>
> Steps to Reproduce:
> 1. Register tcp_illinois:
> # sysctl -w net.ipv4.tcp_congestion_control=illinois
> 2. Monitor internal TCP information via command "ss -i"
> # watch -d ss -i
> 3. Establish new TCP conn to machine
>
> Either it fails at the initial conn, or else it needs to wait
> for a loss or a reset.
>
> This is only related to reading stats. The function avg_delay() also
> performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
> calling point in update_params(). Thus, simply fix tcp_illinois_info().
>
> Function tcp_illinois_info() / get_info() is called without
> socket lock. Thus, eliminate any race condition on ca->cnt_rtt
> by using a local stack variable. Simply reuse info.tcpv_rttcnt,
> as its already set to ca->cnt_rtt.
> Function avg_delay() is not affected by this race condition, as
> its called with the socket lock.
>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
>
> ---
> V2:
> Address Eric Dumazets input:
> - Save 2 bytes of stack, by using info.tcpv_rttcnt.
> - Help compiler, and define "u64 t" inside if() lexical scope.
>
>
> net/ipv4/tcp_illinois.c | 8 +++++---
> 1 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
> index 813b43a..834857f 100644
> --- a/net/ipv4/tcp_illinois.c
> +++ b/net/ipv4/tcp_illinois.c
> @@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
> .tcpv_rttcnt = ca->cnt_rtt,
> .tcpv_minrtt = ca->base_rtt,
> };
> - u64 t = ca->sum_rtt;
>
> - do_div(t, ca->cnt_rtt);
> - info.tcpv_rtt = t;
> + if (info.tcpv_rttcnt > 0) {
> + u64 t = ca->sum_rtt;
>
> + do_div(t, info.tcpv_rttcnt);
> + info.tcpv_rtt = t;
> + }
> nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
> }
> }
>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
^ permalink raw reply
* [PATCH net-next] sockopt: Change getsockopt() of SO_BINDTODEVICE to return an interface name
From: Brian Haley @ 2012-10-31 20:06 UTC (permalink / raw)
To: David Miller; +Cc: Pavel Emelyanov, Eric Dumazet, netdev@vger.kernel.org
Instead of having the getsockopt() of SO_BINDTODEVICE return an index, which
will then require another call like if_indextoname() to get the actual interface
name, have it return the name directly.
This also matches the existing man page description on socket(7) which mentions
the argument being an interface name.
If the value has not been set, zero is returned and optlen will be set to zero
to indicate there is no interface name present.
Signed-off-by: Brian Haley <brian.haley@hp.com>
--
diff --git a/net/core/sock.c b/net/core/sock.c
index 0a023b8..9172ff4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -505,7 +505,8 @@ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie)
}
EXPORT_SYMBOL(sk_dst_check);
-static int sock_bindtodevice(struct sock *sk, char __user *optval, int optlen)
+static int sock_setbindtodevice(struct sock *sk, char __user *optval,
+ int optlen)
{
int ret = -ENOPROTOOPT;
#ifdef CONFIG_NETDEVICES
@@ -562,6 +563,52 @@ out:
return ret;
}
+static int sock_getbindtodevice(struct sock *sk, char __user *optval,
+ int __user *optlen, int len)
+{
+ int ret = -ENOPROTOOPT;
+#ifdef CONFIG_NETDEVICES
+ struct net *net = sock_net(sk);
+ struct net_device *dev;
+ char devname[IFNAMSIZ];
+
+ if (sk->sk_bound_dev_if == 0) {
+ len = 0;
+ goto zero;
+ }
+
+ ret = -EINVAL;
+ if (len < IFNAMSIZ)
+ goto out;
+
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
+ if (dev)
+ strcpy(devname, dev->name);
+ rcu_read_unlock();
+ ret = -ENODEV;
+ if (!dev)
+ goto out;
+
+ len = strlen(devname) + 1;
+
+ ret = -EFAULT;
+ if (copy_to_user(optval, devname, len))
+ goto out;
+
+zero:
+ ret = -EFAULT;
+ if (put_user(len, optlen))
+ goto out;
+
+ ret = 0;
+
+out:
+#endif
+
+ return ret;
+}
+
static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
{
if (valbool)
@@ -589,7 +636,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
*/
if (optname == SO_BINDTODEVICE)
- return sock_bindtodevice(sk, optval, optlen);
+ return sock_setbindtodevice(sk, optval, optlen);
if (optlen < sizeof(int))
return -EINVAL;
@@ -1074,9 +1121,10 @@ int sock_getsockopt(struct socket *sock, int level, int
optname,
case SO_NOFCS:
v.val = sock_flag(sk, SOCK_NOFCS);
break;
+
case SO_BINDTODEVICE:
- v.val = sk->sk_bound_dev_if;
- break;
+ return sock_getbindtodevice(sk, optval, optlen, len);
+
default:
return -ENOPROTOOPT;
}
^ permalink raw reply related
* Re: [PATCH v2 2/3] pppoatm: fix race condition with destroying of vcc
From: chas williams - CONTRACTOR @ 2012-10-31 20:03 UTC (permalink / raw)
To: Krzysztof Mazur; +Cc: davem, dwmw2, netdev, linux-kernel
In-Reply-To: <20121031094147.GA1004@shrek.podlesie.net>
On Wed, 31 Oct 2012 10:41:47 +0100
Krzysztof Mazur <krzysiek@podlesie.net> wrote:
> On Tue, Oct 30, 2012 at 07:20:01PM +0100, Krzysztof Mazur wrote:
> > Yes, this problem can be probably fixed by reversing close and push
> > and adding some synchronization to pppoatm_unassign_vcc(), but I think
> > we need that locking anyway, for instance for synchronization for
> > checking and incrementing sk->sk_wmem_alloc, between pppoatm_send()
> > and vcc_sendmsg().
> >
>
> I think that the same problem exists in other drivers (net/atm/br2684.c,
> net/atm/clip.c, maybe other).
>
> Reversing order of close() and push(vcc, NULL) operations seems to
> be a good idea, but synchronization with push(vcc, NULL)
> and function that calls vcc->send() must be added to all drivers.
this was the scheme that was (and is) currently in place. detaching a
protocol from the atm layer never had a separate function, so it was
decided at some point to just push a NULL skb as a signal to the next
layer that i needed to cleanly shutdown and detach. the push(vcc,
NULL) always happens in a sleepable context, so waiting for whatever
attached protocol scheduler to finish up is not a problem. after the
pushing of the skb NULL, the attached protocol should not send or recv
any data on that vcc.
reversing the order of the push and close certainly seems like the right
thing to do. i would like to see if it would fix your problem. making
the minimal change to get something working would be preferred before
adding additional complexity. i am just surprised we havent seen this
bug before.
> I think it's better to just use ATM socket lock - lock_sock(sk_atm(vcc)),
> it will fix also problems with synchronization with vcc_sendmsg()
> and possibly other functions (ioctl?).
>
> I think that we should add a wrapper to vcc->send(), based on
> fixed pppoatm_send(), that performs required checks and takes the ATM socket
> lock.
>
> But I think we should reverse those operations anyway, because some
> drivers may use other locks, not ATM socket lock, for proper
> synchronization.
i dont think this is a bad idea. vcc_release_async() could happen
(this would be a bit unusual for a pvc but removing the usbatm device
would do this) and there is no point in sending on a vcc that is
closing.
^ permalink raw reply
* RE: [PATCH 4/4] arm/dts: am33xx: Add CPSW and MDIO module nodes for AM33XX
From: Hiremath, Vaibhav @ 2012-10-31 19:52 UTC (permalink / raw)
To: Cousson, Benoit
Cc: netdev@vger.kernel.org, paul@pwsan.com,
linux-arm-kernel@lists.infradead.org, linux-omap@vger.kernel.org,
N, Mugunthan V, Richard Cochran
In-Reply-To: <50914107.2090909@ti.com>
On Wed, Oct 31, 2012 at 20:47:27, Cousson, Benoit wrote:
> Hi,
>
> On 10/29/2012 09:21 AM, Vaibhav Hiremath wrote:
> > From: Mugunthan V N <mugunthanvnm@ti.com>
> >
> > Add CPSW and MDIO related device tree data for AM33XX.
> > Also enable them into board/evm dts files by providing
> > respective phy-id.
>
> Is there any bindings documentation for that device?
>
Yes, the base DT binding documentation is present in file
Documentation/devicetree/bindings/net/cpsw.txt
> > Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
> > Signed-off-by: Vaibhav Hiremath <hvaibhav@ti.com>
> > Cc: Richard Cochran <richardcochran@gmail.com>
> > Cc: Benoit Cousson <b-cousson@ti.com>
> > ---
> > arch/arm/boot/dts/am335x-bone.dts | 8 ++++++
> > arch/arm/boot/dts/am335x-evm.dts | 8 ++++++
> > arch/arm/boot/dts/am33xx.dtsi | 50 +++++++++++++++++++++++++++++++++++++
> > 3 files changed, 66 insertions(+), 0 deletions(-)
> >
> > diff --git a/arch/arm/boot/dts/am335x-bone.dts b/arch/arm/boot/dts/am335x-bone.dts
> > index c634f87..e233cfa 100644
> > --- a/arch/arm/boot/dts/am335x-bone.dts
> > +++ b/arch/arm/boot/dts/am335x-bone.dts
> > @@ -78,3 +78,11 @@
> > };
> > };
> > };
> > +
> > +&cpsw_emac0 {
> > + phy_id = "4a101000.mdio:00";
>
> Why are you using that kind of interface? You seem to want a reference
> to a device.
>
> Cannot you have something less hard coded like:
> phy_id = <&davinci_mdio>, <0>;
>
>
> > +};
> > +
> > +&cpsw_emac1 {
> > + phy_id = "4a101000.mdio:01";
> > +};
> > diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
> > index 185d632..415c3b3 100644
> > --- a/arch/arm/boot/dts/am335x-evm.dts
> > +++ b/arch/arm/boot/dts/am335x-evm.dts
> > @@ -118,3 +118,11 @@
> > };
> > };
> > };
> > +
> > +&cpsw_emac0 {
> > + phy_id = "4a101000.mdio:00";
> > +};
> > +
> > +&cpsw_emac1 {
> > + phy_id = "4a101000.mdio:01";
> > +};
> > diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
> > index bb31bff..f6bea04 100644
> > --- a/arch/arm/boot/dts/am33xx.dtsi
> > +++ b/arch/arm/boot/dts/am33xx.dtsi
> > @@ -210,5 +210,55 @@
> > interrupt-parent = <&intc>;
> > interrupts = <91>;
> > };
> > +
> > + mac: ethernet@4A100000 {
>
> hexa data should be in lower case.
>
Oops. Will correct it.
> > + compatible = "ti,cpsw";
> > + ti,hwmods = "cpgmac0";
> > + cpdma_channels = <8>;
> > + host_port_no = <0>;
> > + cpdma_reg_ofs = <0x800>;
> > + cpdma_sram_ofs = <0xa00>;
> > + ale_reg_ofs = <0xd00>;
> > + ale_entries = <1024>;
> > + host_port_reg_ofs = <0x108>;
> > + hw_stats_reg_ofs = <0x900>;
> > + bd_ram_ofs = <0x2000>;
> > + bd_ram_size = <0x2000>;
> > + no_bd_ram = <0>;
> > + rx_descs = <64>;
> > + mac_control = <0x20>;
>
> Do you have to store all these data in the DTS? Cannot it be in the driver?
>
> Do you expect to have several instance of the same IP with different
> parameters here?
>
I will let Mugunthan respond to this.
> > + slaves = <2>;
> > + reg = <0x4a100000 0x800
> > + 0x4a101200 0x100
> > + 0x4a101000 0x100>;
>
> Please align the address.
Ok.
>
> > + #address-cells = <1>;
> > + #size-cells = <1>;
> > + interrupt-parent = <&intc>;
> > + /* c0_rx_thresh_pend c0_rx_pend c0_tx_pend c0_misc_pend*/
>
> Please use a standard multi-line comment instead of trying to put
> everything in one line.
>
Oops. Will correct it.
> > + interrupts = <40 41 42 43>;
> > + ranges;
>
> You should add blank line here for readability.
>
OK.
> > + cpsw_emac0: slave@0 {
>
> Mmm, you are using some address later and here some relative number,
> that does not looks very consistent.
>
> > + slave_reg_ofs = <0x208>;
>
> Is it an offset from 4a100000? Cannot you use the address for the slave
> name?
>
> Something like that: cpsw_emac0: slave@4a100208
>
> > + sliver_reg_ofs = <0xd80>;
> > + /* Filled in by U-Boot */
> > + mac-address = [ 00 00 00 00 00 00 ];
> > + };
>
> You should add blank line here for readability.
>
Ok
Thanks,
Vaibhav
^ permalink raw reply
* Re: skb_linearize
From: Michael S. Tsirkin @ 2012-10-31 19:15 UTC (permalink / raw)
To: Ben Hutchings; +Cc: netdev, Herbert Xu
In-Reply-To: <1347808032.13258.275.camel@deadeye.wl.decadent.org.uk>
On Sun, Sep 16, 2012 at 04:07:12PM +0100, Ben Hutchings wrote:
> On Sun, 2012-09-16 at 12:17 +0300, Michael S. Tsirkin wrote:
> > I notice that dev_hard_start_xmit might invoke
> > __skb_linearize e.g. if device does not support NETIF_F_SG.
> >
> > This in turn onvokes __pskb_pull_tail, and
> > documentation of __pskb_pull_tail says:
> > &sk_buff MUST have reference count of 1.
> >
> > I am guessing 'reference count' means users in this context, right?
> > IIUC this is because it modifies skb in a way that
> > isn't safe if anyone else is looking at the skb.
> >
> >
> > However, I don't see what guarantees that reference
> > count is 1 when dev_hard_start_xmit invokes
> > linearize. In particular it calls dev_queue_xmit_nit
> > which could queue packets on a network tap.
> >
> > Could someone help me understand please?
>
> Reference count here means references to struct sk_buff itself. The
> header area and data fragments are allowed to be shared.
>
> dev_queue_xmit_nit() clones the skb for each tap, so the reference count
> on the original skb remains 1.
>
> Ben.
Interesting. But don't skb clones share the fragment list?
Maybe I misunderstand? If they do it looks like the following race
would be possible:
- skb is cloned and queued e.g. at socket receive queue.
dataref becomes 2.
- On CPU 1, skb_copy_datagram_iovec is called on clone 1, is reads nr_frags and sees
value > 1.
- On CPU 2, __skb_linearize is now called on clone 2, it modified the
skb so nr_frags is now 0, and does put_page for all frags > 1.
- On CPU 1, skb_copy_datagram_iovec will now use the previously read
nr_frags > 1 and access a fragment page that was already freed.
What did I miss?
> --
> Ben Hutchings, Staff Engineer, Solarflare
> Not speaking for my employer; that's the marketing department's job.
> They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: pull request: wireless 2012-10-31
From: David Miller @ 2012-10-31 18:59 UTC (permalink / raw)
To: linville; +Cc: linux-wireless, netdev, linux-kernel
In-Reply-To: <20121031173740.GB30910@tuxdriver.com>
From: "John W. Linville" <linville@tuxdriver.com>
Date: Wed, 31 Oct 2012 13:37:40 -0400
> The biggest portion of this is a pull request from Johannes Berg:
>
> "Please pull my mac80211.git tree per below to get a number of fixes. I
> have included a patch from Antonio to fix a memcpy overrun, Felix's
> patches for the antenna gain/tx power issues, a few mesh-related fixes
> from Javier for mac80211 and my own patches to not access data that
> might not be present in an skb at all as well as a patch (the duplicate
> IE check one) to make mac80211 forward-compatible with potential future
> spec extensions that use the same IE multiple times.
>
> It's a bit bigger than I'd like maybe, but I think all of these are
> worthwhile fixes at this point."
>
> In addition...
>
> Felix Fietkau fixes an ath9k use-after-free issue.
>
> Stanislaw Gruszka adds a valid value check to rt2800.
>
> Sven Eckelmann adds a check to only check a TID value in a BlockAck, for
> frames that could be either a BlockAck or a normal Ack.
Pulled, thanks John.
^ permalink raw reply
* Re: [PATCH 0/3] netfilter updates for the net tree
From: David Miller @ 2012-10-31 18:57 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
In-Reply-To: <1351592360-5686-1-git-send-email-pablo@netfilter.org>
From: pablo@netfilter.org
Date: Tue, 30 Oct 2012 11:19:17 +0100
> The following patchset contains fixes for your net tree, two of them
> are due to relatively recent changes, one has been a longstanding bug,
> they are:
>
> * Fix incorrect usage of rt_gateway in the H.323 helper, from
> Julian Anastasov.
>
> * Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
> enabled, we waste cycles to look up for the route again. This problem
> seems to be there since really long time. From Ulrich Weber.
>
> * Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
>
> You can pull this changes from:
>
> git://1984.lsi.us.es/nf master
Pulled, thanks.
^ permalink raw reply
* Re: [net-next 00/13][pull request] Intel Wired LAN Driver Updates
From: David Miller @ 2012-10-31 18:28 UTC (permalink / raw)
To: jeffrey.t.kirsher; +Cc: netdev, gospo, sassmann
In-Reply-To: <1351580670-8292-1-git-send-email-jeffrey.t.kirsher@intel.com>
From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Date: Tue, 30 Oct 2012 00:04:17 -0700
> This series contains updates to ixgbe, ixgbevf, igbvf, igb and
> networking core (bridge). Most notably is the addition of support
> for local link multicast addresses in SR-IOV mode to the networking
> core.
>
> Also note, the ixgbe patch "ixgbe: Add support for pipeline reset" and
> "ixgbe: Fix return value from macvlan filter function" is revised based
> on community feedback.
Pulled, thanks Jeff.
^ permalink raw reply
* Re: [net-next resend v4 5/7] tuntap: multiqueue support
From: David Miller @ 2012-10-31 18:16 UTC (permalink / raw)
To: jasowang
Cc: mst, netdev, linux-kernel, maxk, edumazet, krkumar2,
ernesto.martin, haixiao
In-Reply-To: <1351491351-11477-6-git-send-email-jasowang@redhat.com>
From: Jason Wang <jasowang@redhat.com>
Date: Mon, 29 Oct 2012 14:15:49 +0800
> @@ -110,6 +110,11 @@ struct tap_filter {
> unsigned char addr[FLT_EXACT_COUNT][ETH_ALEN];
> };
>
> +/* 1024 is probably a high enough limit: modern hypervisors seem to support on
> + * the order of 100-200 CPUs so this leaves us some breathing space if we want
> + * to match a queue per guest CPU. */
Please don't format comments like this. Put that final "*/" on it's
own line.
I'm really perplexed how you can get it right elsewhere in your
patches, and then botch it up only in a few select locations :-/
> +/* We try to identify a flow through its rxhash first. The reason that
> + * we do not check rxq no. is becuase some cards(e.g 82599), chooses
> + * the rxq based on the txq where the last packet of the flow comes. As
> + * the userspace application move between processors, we may get a
> + * different rxq no. here. If we could not get rxhash, then we would
> + * hope the rxq no. may help here.
> + */
For example, this one is done right.
^ permalink raw reply
* Re: [PATCH] tcp: make tcp_clear_md5_list static
From: David Miller @ 2012-10-31 18:05 UTC (permalink / raw)
To: shemminger; +Cc: netdev
In-Reply-To: <20121026173140.54fb1f6f@nehalam.linuxnetplumber.net>
From: Stephen Hemminger <shemminger@vyatta.com>
Date: Fri, 26 Oct 2012 17:31:40 -0700
> Trivial. Only used in one file.
>
> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next] net: compute skb->rxhash if nic hash may be 3-tuple
From: David Miller @ 2012-10-31 18:04 UTC (permalink / raw)
To: willemb; +Cc: edumazet, netdev
In-Reply-To: <1351288328-30147-1-git-send-email-willemb@google.com>
Applied.
^ permalink raw reply
* Re: [PATCH] dlink: dl2k: use the module_pci_driver macro
From: David Miller @ 2012-10-31 18:04 UTC (permalink / raw)
To: devendra.aaru; +Cc: romieu, netdev
In-Reply-To: <1351279740-16519-1-git-send-email-devendra.aaru@gmail.com>
From: Devendra Naga <devendra.aaru@gmail.com>
Date: Fri, 26 Oct 2012 15:29:00 -0400
> use the module_pci_driver macro to make the code simpler
> by eliminating module_init and module_exit calls.
>
> Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH] realtek: r8169: use module_pci_driver macro
From: David Miller @ 2012-10-31 18:04 UTC (permalink / raw)
To: devendra.aaru; +Cc: romieu, netdev
In-Reply-To: <1351279662-16466-1-git-send-email-devendra.aaru@gmail.com>
From: Devendra Naga <devendra.aaru@gmail.com>
Date: Fri, 26 Oct 2012 15:27:42 -0400
> use the module_pci_driver macro to make the code simpler
> by eliminating the module_init and module_exit calls
>
> Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Applied.
^ permalink raw reply
* Re: pull request: batman-adv 202-10-29
From: David Miller @ 2012-10-31 17:53 UTC (permalink / raw)
To: ordex; +Cc: netdev, b.a.t.m.a.n
In-Reply-To: <1351501097-1289-1-git-send-email-ordex@autistici.org>
From: Antonio Quartulli <ordex@autistici.org>
Date: Mon, 29 Oct 2012 09:58:01 +0100
> this is again our first set of changes intended for net-next/linux-3.8.
> With respect to the previous changeset we substituted the patch changing the
> BAT_ATTR_HIF_UINT macro with a new one that removes it (we will re-add such
> macro together with the user).
> The rest is exactly the same as before.
Pulled, thanks.
^ permalink raw reply
* pull request: wireless 2012-10-31
From: John W. Linville @ 2012-10-31 17:37 UTC (permalink / raw)
To: davem; +Cc: linux-wireless, netdev, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 17177 bytes --]
commit 06272911485850b4a336122958c50af0f8ea7c13
Dave,
This is a batch of fixes intended for 3.7...
The biggest portion of this is a pull request from Johannes Berg:
"Please pull my mac80211.git tree per below to get a number of fixes. I
have included a patch from Antonio to fix a memcpy overrun, Felix's
patches for the antenna gain/tx power issues, a few mesh-related fixes
from Javier for mac80211 and my own patches to not access data that
might not be present in an skb at all as well as a patch (the duplicate
IE check one) to make mac80211 forward-compatible with potential future
spec extensions that use the same IE multiple times.
It's a bit bigger than I'd like maybe, but I think all of these are
worthwhile fixes at this point."
In addition...
Felix Fietkau fixes an ath9k use-after-free issue.
Stanislaw Gruszka adds a valid value check to rt2800.
Sven Eckelmann adds a check to only check a TID value in a BlockAck, for
frames that could be either a BlockAck or a normal Ack.
Please let me know if there are problems!
John
P.S. Stay safe in NYC! It must be tough there right now. Let me know
if I can somehow be helpful to you! Anyway, I wanted to go ahead and
post this now for when you do find the means to process pull requests.
If you would prefer that I do something else, then please let me know!
---
The following changes since commit e657e078d3dfa9f96976db7a2b5fd7d7c9f1f1a6:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2012-10-26 15:00:48 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git for-davem
for you to fetch changes up to 06272911485850b4a336122958c50af0f8ea7c13:
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem (2012-10-31 13:10:01 -0400)
----------------------------------------------------------------
Antonio Quartulli (1):
mac80211: fix SSID copy on IBSS JOIN
Felix Fietkau (3):
cfg80211: fix antenna gain handling
cfg80211: fix initialization of chan->max_reg_power
ath9k: fix stale pointers potentially causing access to free'd skbs
Javier Cardona (3):
mac80211: Only process mesh config header on frames that RA_MATCH
mac80211: Don't drop frames received with mesh ttl == 1
mac80211: don't inspect Sequence Control field on control frames
Johannes Berg (5):
mac80211: use blacklist for duplicate IE check
wireless: drop invalid mesh address extension frames
mac80211: check management frame header length
mac80211: verify that skb data is present
mac80211: make sure data is accessible in EAPOL check
John W. Linville (2):
Merge branch 'for-john' of git://git.kernel.org/.../jberg/mac80211
Merge branch 'master' of git://git.kernel.org/.../linville/wireless into for-davem
Stanislaw Gruszka (1):
rt2800: validate step value for temperature compensation
Sven Eckelmann (1):
ath9k: Test for TID only in BlockAcks while checking tx status
drivers/net/wireless/ath/ath9k/xmit.c | 10 ++++-
drivers/net/wireless/rt2x00/rt2800lib.c | 2 +-
include/net/cfg80211.h | 9 ++++
net/mac80211/ibss.c | 2 +-
net/mac80211/rx.c | 74 +++++++++++++++++++++++++--------
net/mac80211/util.c | 42 +++++++++++++++----
net/wireless/core.c | 3 +-
net/wireless/reg.c | 5 ++-
net/wireless/util.c | 14 ++++---
9 files changed, 122 insertions(+), 39 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 378bd70..741918a 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -312,6 +312,7 @@ static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)
}
bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
+ bf->bf_next = NULL;
list_del(&bf->list);
spin_unlock_bh(&sc->tx.txbuflock);
@@ -393,7 +394,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0, seq_first;
u32 ba[WME_BA_BMP_SIZE >> 5];
int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
- bool rc_update = true;
+ bool rc_update = true, isba;
struct ieee80211_tx_rate rates[4];
struct ath_frame_info *fi;
int nframes;
@@ -437,13 +438,17 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
tid = ATH_AN_2_TID(an, tidno);
seq_first = tid->seq_start;
+ isba = ts->ts_flags & ATH9K_TX_BA;
/*
* The hardware occasionally sends a tx status for the wrong TID.
* In this case, the BA status cannot be considered valid and all
* subframes need to be retransmitted
+ *
+ * Only BlockAcks have a TID and therefore normal Acks cannot be
+ * checked
*/
- if (tidno != ts->tid)
+ if (isba && tidno != ts->tid)
txok = false;
isaggr = bf_isaggr(bf);
@@ -1774,6 +1779,7 @@ static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
list_add_tail(&bf->list, &bf_head);
bf->bf_state.bf_type = 0;
+ bf->bf_next = NULL;
bf->bf_lastbf = bf;
ath_tx_fill_desc(sc, bf, txq, fi->framelen);
ath_tx_txqaddbuf(sc, txq, &bf_head, false);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 01dc889..59474ae 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2449,7 +2449,7 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev)
/*
* Check if temperature compensation is supported.
*/
- if (tssi_bounds[4] == 0xff)
+ if (tssi_bounds[4] == 0xff || step == 0xff)
return 0;
/*
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f8cd4cf..7d5b600 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2652,6 +2652,15 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
/**
+ * ieee80211_get_mesh_hdrlen - get mesh extension header length
+ * @meshhdr: the mesh extension header, only the flags field
+ * (first byte) will be accessed
+ * Returns the length of the extension header, which is always at
+ * least 6 bytes and at most 18 if address 5 and 6 are present.
+ */
+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
+
+/**
* DOC: Data path helpers
*
* In addition to generic utilities, cfg80211 also offers
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 5f3620f..bf87c70 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1108,7 +1108,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
sdata->u.ibss.ibss_join_req = jiffies;
- memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
+ memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
sdata->u.ibss.ssid_len = params->ssid_len;
mutex_unlock(&sdata->u.ibss.mtx);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 61c621e..00ade7f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -531,6 +531,11 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
if (ieee80211_is_action(hdr->frame_control)) {
u8 category;
+
+ /* make sure category field is present */
+ if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
+ return RX_DROP_MONITOR;
+
mgmt = (struct ieee80211_mgmt *)hdr;
category = mgmt->u.action.category;
if (category != WLAN_CATEGORY_MESH_ACTION &&
@@ -883,14 +888,16 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
*/
if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
ieee80211_is_data_present(hdr->frame_control)) {
- u16 ethertype;
- u8 *payload;
-
- payload = rx->skb->data +
- ieee80211_hdrlen(hdr->frame_control);
- ethertype = (payload[6] << 8) | payload[7];
- if (cpu_to_be16(ethertype) ==
- rx->sdata->control_port_protocol)
+ unsigned int hdrlen;
+ __be16 ethertype;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+ if (rx->skb->len < hdrlen + 8)
+ return RX_DROP_MONITOR;
+
+ skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2);
+ if (ethertype == rx->sdata->control_port_protocol)
return RX_CONTINUE;
}
@@ -1462,11 +1469,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
hdr = (struct ieee80211_hdr *)rx->skb->data;
fc = hdr->frame_control;
+
+ if (ieee80211_is_ctl(fc))
+ return RX_CONTINUE;
+
sc = le16_to_cpu(hdr->seq_ctrl);
frag = sc & IEEE80211_SCTL_FRAG;
if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
- (rx->skb)->len < 24 ||
is_multicast_ether_addr(hdr->addr1))) {
/* not fragmented */
goto out;
@@ -1889,6 +1899,20 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
hdr = (struct ieee80211_hdr *) skb->data;
hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+ /* make sure fixed part of mesh header is there, also checks skb len */
+ if (!pskb_may_pull(rx->skb, hdrlen + 6))
+ return RX_DROP_MONITOR;
+
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
+ /* make sure full mesh header is there, also checks skb len */
+ if (!pskb_may_pull(rx->skb,
+ hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
+ return RX_DROP_MONITOR;
+
+ /* reload pointers */
+ hdr = (struct ieee80211_hdr *) skb->data;
mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
/* frame is in RMC, don't forward */
@@ -1897,7 +1921,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
return RX_DROP_MONITOR;
- if (!ieee80211_is_data(hdr->frame_control))
+ if (!ieee80211_is_data(hdr->frame_control) ||
+ !(status->rx_flags & IEEE80211_RX_RA_MATCH))
return RX_CONTINUE;
if (!mesh_hdr->ttl)
@@ -1911,9 +1936,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
if (is_multicast_ether_addr(hdr->addr1)) {
mpp_addr = hdr->addr3;
proxied_addr = mesh_hdr->eaddr1;
- } else {
+ } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+ /* has_a4 already checked in ieee80211_rx_mesh_check */
mpp_addr = hdr->addr4;
proxied_addr = mesh_hdr->eaddr2;
+ } else {
+ return RX_DROP_MONITOR;
}
rcu_read_lock();
@@ -1941,12 +1969,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
}
skb_set_queue_mapping(skb, q);
- if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
- goto out;
-
if (!--mesh_hdr->ttl) {
IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
- return RX_DROP_MONITOR;
+ goto out;
}
if (!ifmsh->mshcfg.dot11MeshForwarding)
@@ -2353,6 +2378,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_SELF_PROTECTED:
+ if (len < (IEEE80211_MIN_ACTION_SIZE +
+ sizeof(mgmt->u.action.u.self_prot.action_code)))
+ break;
+
switch (mgmt->u.action.u.self_prot.action_code) {
case WLAN_SP_MESH_PEERING_OPEN:
case WLAN_SP_MESH_PEERING_CLOSE:
@@ -2371,6 +2400,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_MESH_ACTION:
+ if (len < (IEEE80211_MIN_ACTION_SIZE +
+ sizeof(mgmt->u.action.u.mesh_action.action_code)))
+ break;
+
if (!ieee80211_vif_is_mesh(&sdata->vif))
break;
if (mesh_action_is_path_sel(mgmt) &&
@@ -2913,10 +2946,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
local->dot11ReceivedFragmentCount++;
- if (ieee80211_is_mgmt(fc))
- err = skb_linearize(skb);
- else
+ if (ieee80211_is_mgmt(fc)) {
+ /* drop frame if too short for header */
+ if (skb->len < ieee80211_hdrlen(fc))
+ err = -ENOBUFS;
+ else
+ err = skb_linearize(skb);
+ } else {
err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
+ }
if (err) {
dev_kfree_skb(skb);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 94e5868..2393918 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -643,13 +643,41 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
break;
}
- if (id != WLAN_EID_VENDOR_SPECIFIC &&
- id != WLAN_EID_QUIET &&
- test_bit(id, seen_elems)) {
- elems->parse_error = true;
- left -= elen;
- pos += elen;
- continue;
+ switch (id) {
+ case WLAN_EID_SSID:
+ case WLAN_EID_SUPP_RATES:
+ case WLAN_EID_FH_PARAMS:
+ case WLAN_EID_DS_PARAMS:
+ case WLAN_EID_CF_PARAMS:
+ case WLAN_EID_TIM:
+ case WLAN_EID_IBSS_PARAMS:
+ case WLAN_EID_CHALLENGE:
+ case WLAN_EID_RSN:
+ case WLAN_EID_ERP_INFO:
+ case WLAN_EID_EXT_SUPP_RATES:
+ case WLAN_EID_HT_CAPABILITY:
+ case WLAN_EID_HT_OPERATION:
+ case WLAN_EID_VHT_CAPABILITY:
+ case WLAN_EID_VHT_OPERATION:
+ case WLAN_EID_MESH_ID:
+ case WLAN_EID_MESH_CONFIG:
+ case WLAN_EID_PEER_MGMT:
+ case WLAN_EID_PREQ:
+ case WLAN_EID_PREP:
+ case WLAN_EID_PERR:
+ case WLAN_EID_RANN:
+ case WLAN_EID_CHANNEL_SWITCH:
+ case WLAN_EID_EXT_CHANSWITCH_ANN:
+ case WLAN_EID_COUNTRY:
+ case WLAN_EID_PWR_CONSTRAINT:
+ case WLAN_EID_TIMEOUT_INTERVAL:
+ if (test_bit(id, seen_elems)) {
+ elems->parse_error = true;
+ left -= elen;
+ pos += elen;
+ continue;
+ }
+ break;
}
if (calc_crc && id < 64 && (filter & (1ULL << id)))
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 443d4d7..3f72530 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -526,8 +526,7 @@ int wiphy_register(struct wiphy *wiphy)
for (i = 0; i < sband->n_channels; i++) {
sband->channels[i].orig_flags =
sband->channels[i].flags;
- sband->channels[i].orig_mag =
- sband->channels[i].max_antenna_gain;
+ sband->channels[i].orig_mag = INT_MAX;
sband->channels[i].orig_mpwr =
sband->channels[i].max_power;
sband->channels[i].band = band;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 3b8cbbc..bcc7d7e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -908,7 +908,7 @@ static void handle_channel(struct wiphy *wiphy,
map_regdom_flags(reg_rule->flags) | bw_flags;
chan->max_antenna_gain = chan->orig_mag =
(int) MBI_TO_DBI(power_rule->max_antenna_gain);
- chan->max_power = chan->orig_mpwr =
+ chan->max_reg_power = chan->max_power = chan->orig_mpwr =
(int) MBM_TO_DBM(power_rule->max_eirp);
return;
}
@@ -1331,7 +1331,8 @@ static void handle_channel_custom(struct wiphy *wiphy,
chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
- chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+ chan->max_reg_power = chan->max_power =
+ (int) MBM_TO_DBM(power_rule->max_eirp);
}
static void handle_band_custom(struct wiphy *wiphy, enum ieee80211_band band,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ef35f4e..2762e83 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -309,23 +309,21 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
}
EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
-static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
{
int ae = meshhdr->flags & MESH_FLAGS_AE;
- /* 7.1.3.5a.2 */
+ /* 802.11-2012, 8.2.4.7.3 */
switch (ae) {
+ default:
case 0:
return 6;
case MESH_FLAGS_AE_A4:
return 12;
case MESH_FLAGS_AE_A5_A6:
return 18;
- case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
- return 24;
- default:
- return 6;
}
}
+EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
enum nl80211_iftype iftype)
@@ -373,6 +371,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
/* make sure meshdr->flags is on the linear part */
if (!pskb_may_pull(skb, hdrlen + 1))
return -1;
+ if (meshdr->flags & MESH_FLAGS_AE_A4)
+ return -1;
if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
skb_copy_bits(skb, hdrlen +
offsetof(struct ieee80211s_hdr, eaddr1),
@@ -397,6 +397,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
/* make sure meshdr->flags is on the linear part */
if (!pskb_may_pull(skb, hdrlen + 1))
return -1;
+ if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
+ return -1;
if (meshdr->flags & MESH_FLAGS_AE_A4)
skb_copy_bits(skb, hdrlen +
offsetof(struct ieee80211s_hdr, eaddr1),
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply related
* Re: [PATCH net-next] sk-filter: Add ability to get socket filter program
From: David Miller @ 2012-10-31 17:45 UTC (permalink / raw)
To: xemul; +Cc: netdev
In-Reply-To: <508AC533.4000809@parallels.com>
You can't only add this to asm-generic, you must add the new
option to all the arch specific headers that need it too.
^ permalink raw reply
* Re: [PATCH] vxlan: don't expire permanent entries
From: David Miller @ 2012-10-31 17:42 UTC (permalink / raw)
To: shemminger; +Cc: john.southworth, netdev
In-Reply-To: <20121026092434.4d735316@nehalam.linuxnetplumber.net>
From: Stephen Hemminger <shemminger@vyatta.com>
Date: Fri, 26 Oct 2012 09:24:34 -0700
> VXLAN confused flag versus bitmap on state.
> Based on part of a earlier patch by David Stevens.
>
> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Applied.
^ permalink raw reply
* Re: [PATCH 4/9] net: openvswitch: use this_cpu_ptr per-cpu helper
From: Christoph Lameter @ 2012-10-31 17:39 UTC (permalink / raw)
To: Shan Wei
Cc: dev-yBygre7rU0TnMu66kgdUjQ, NetDev, Kernel-Maillist, David Miller
In-Reply-To: <50910A04.5000003-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
On Wed, 31 Oct 2012, Shan Wei wrote:
> --- a/net/openvswitch/datapath.c
> +++ b/net/openvswitch/datapath.c
> @@ -208,7 +208,7 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
> int error;
> int key_len;
>
> - stats = per_cpu_ptr(dp->stats_percpu, smp_processor_id());
> + stats = this_cpu_ptr(dp->stats_percpu);
Well this is an improvement and may be ok if the preemption is disabled at
this point. There is another possibility here to use this_cpu_read/add/inc
instead of determining the pointer to the local cpu first and then
performing operations on the fields. The pointer relocation with
this_cpu_xxx ops is implicit in the instructions and safe against changing
of processors. It would also save us the determination of a pointer to the
current cpus stats structure.
^ permalink raw reply
* Re: [PATCH -next] qla3xxx: remove unused variable in ql_process_mac_tx_intr()
From: David Miller @ 2012-10-31 17:36 UTC (permalink / raw)
To: weiyj.lk; +Cc: jitendra.kalsaria, ron.mercer, yongjun_wei, linux-driver, netdev
In-Reply-To: <CAPgLHd-rHiLuMR45R7uDWx=BVNr01XpcG6XG0_uMwjbhUGyKEw@mail.gmail.com>
From: Wei Yongjun <weiyj.lk@gmail.com>
Date: Fri, 26 Oct 2012 23:30:31 +0800
> From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>
> The variable retval is initialized but never used
> otherwise, so remove the unused variable.
>
> dpatch engine is used to auto generate this patch.
> (https://github.com/weiyj/dpatch)
>
> Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Applied.
^ permalink raw reply
* Re: [PATCH -next] qla3xxx: use module_pci_driver to simplify the code
From: David Miller @ 2012-10-31 17:36 UTC (permalink / raw)
To: weiyj.lk; +Cc: jitendra.kalsaria, ron.mercer, yongjun_wei, linux-driver, netdev
In-Reply-To: <CAPgLHd_Xu7TKZ_mqQ2r7A2GVCo+Us6kEggHc5d+hhg4Hh6cukA@mail.gmail.com>
From: Wei Yongjun <weiyj.lk@gmail.com>
Date: Fri, 26 Oct 2012 23:02:30 +0800
> From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>
> Use the module_pci_driver() macro to make the code simpler
> by eliminating module_init and module_exit calls.
>
> dpatch engine is used to auto generate this patch.
> (https://github.com/weiyj/dpatch)
>
> Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Applied.
^ permalink raw reply
* Re: [PATCH 3/9] net: xfrm: use this_cpu_ptr per-cpu helper
From: Christoph Lameter @ 2012-10-31 17:35 UTC (permalink / raw)
To: Shan Wei
Cc: steffen.klassert, David Miller, NetDev, Herbert Xu,
Kernel-Maillist
In-Reply-To: <509109F9.3030904@gmail.com>
On Wed, 31 Oct 2012, Shan Wei wrote:
> -
> list_for_each_entry(pos, &ipcomp_tfms_list, list) {
> struct crypto_comp *tfm;
>
> tfms = pos->tfms;
> - tfm = *per_cpu_ptr(tfms, cpu);
> +
> + /* This can be any valid CPU ID so we don't need locking. */
> + tfm = *this_cpu_ptr(tfms);
It would be better to use
this_cpu_read(tfms)
since that would also make it atomic vs interrupts. The above code (both
original and modified) could determine a pointer to a per cpu structure
and then take an interrupt which would move the task. On return we would
be accessing the per cpu variable of another processor.
^ permalink raw reply
* Re: [PATCH 1/1] smsc95xx: add wol support for more frame types
From: David Miller @ 2012-10-31 17:33 UTC (permalink / raw)
To: steve.glendinning; +Cc: netdev
In-Reply-To: <1351259036-5375-2-git-send-email-steve.glendinning@shawell.net>
From: Steve Glendinning <steve.glendinning@shawell.net>
Date: Fri, 26 Oct 2012 14:43:56 +0100
> This patch adds support for wol wakeup on unicast, broadcast,
> multicast and arp frames.
>
> The wakeup filter code isn't pretty, but it works.
>
> Signed-off-by: Steve Glendinning <steve.glendinning@shawell.net>
Applied.
^ permalink raw reply
* Re: [PATCH 2/9] net: rds: use this_cpu_ptr per-cpu helper
From: Christoph Lameter @ 2012-10-31 17:32 UTC (permalink / raw)
To: Shan Wei
Cc: venkat.x.venkatsubra, David Miller, rds-devel, NetDev,
Kernel-Maillist
In-Reply-To: <509109ED.7060900@gmail.com>
On Wed, 31 Oct 2012, Shan Wei wrote:
> diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
> index 8d19491..a4a5064 100644
> --- a/net/rds/ib_recv.c
> +++ b/net/rds/ib_recv.c
> @@ -423,7 +423,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
>
> local_irq_save(flags);
>
> - chp = per_cpu_ptr(cache->percpu, smp_processor_id());
> + chp = this_cpu_ptr(cache->percpu);
> if (!chp->first)
> INIT_LIST_HEAD(new_item);
> else /* put on front */
>
Reviewed-by: Christoph Lameter <cl@linux.com>
^ permalink raw reply
* Re: [PATCH 1/9] net: core: use this_cpu_ptr per-cpu helper
From: Christoph Lameter @ 2012-10-31 17:31 UTC (permalink / raw)
To: Shan Wei
Cc: David Miller, timo.teras, steffen.klassert, NetDev,
Kernel-Maillist
In-Reply-To: <509109E1.6040607@gmail.com>
On Wed, 31 Oct 2012, Shan Wei wrote:
> +++ b/net/core/flow.c
> @@ -327,11 +327,9 @@ static void flow_cache_flush_tasklet(unsigned long data)
> static void flow_cache_flush_per_cpu(void *data)
> {
> struct flow_flush_info *info = data;
> - int cpu;
> struct tasklet_struct *tasklet;
>
> - cpu = smp_processor_id();
> - tasklet = &per_cpu_ptr(info->cache->percpu, cpu)->flush_tasklet;
> + tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet;
> tasklet->data = (unsigned long)info;
> tasklet_schedule(tasklet);
> }
>
Reviewed-by: Christoph Lameter <cl@linux.com>
^ permalink raw reply
* Re: [PATCH 0/9] use this_cpu_ptr instead of per_cpu_ptr(p, smp_processor_id())
From: Christoph Lameter @ 2012-10-31 17:28 UTC (permalink / raw)
To: Shan Wei; +Cc: David Miller, NetDev, Kernel-Maillist
In-Reply-To: <509109D2.9030209@gmail.com>
On Wed, 31 Oct 2012, Shan Wei wrote:
> this_cpu_ptr is faster than per_cpu_ptr(p, smp_processor_id()).
> The latter helper needs to find the offset for current cpu,
> and needs more assembler instructions which objdump shows in following.
The code is shorter and that helps but note that the main effect is that
memory accesses are reduced.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox