* Re: [PATCH net-next v2] packet: tx_ring: allow the user to choose tx data offset
From: Paul Chavent @ 2012-10-31 21:22 UTC (permalink / raw)
To: David Miller; +Cc: Paul.Chavent, netdev
In-Reply-To: <20121031.131434.910561089094397853.davem@davemloft.net>
On 10/31/2012 06:14 PM, David Miller wrote:
> From: Paul Chavent <Paul.Chavent@onera.fr>
> Date: Mon, 22 Oct 2012 08:56:54 +0200
>
>> + if (unlikely((off < off_min) || (off_max < off))) {
>> + pr_err("payload offset (%d) out of range [%d;%d]\n",
>> + off, off_min, off_max);
>> + return -EINVAL;
>> + }
>
> Users should not be able to spam the kernel log with error messages
> by simply make setsockopt() calls.
>
> This error log is inappropriate.
This error log is thrown when the user call send, not setsockopt !
It seems that the user can already fire an error msg by simply pass a too long tp_len.
Though, should i remove it from the tpacket_fill_skb function and silently return -EINVAL ?
>> @@ -110,6 +110,7 @@ struct packet_sock {
>> unsigned int tp_reserve;
>> unsigned int tp_loss:1;
>> unsigned int tp_tstamp;
>> + unsigned int tp_tx_has_off:1;
>> struct packet_type prot_hook ____cacheline_aligned_in_smp;
>> };
>
> Please put the new bit field next to other existing bit fields so that
> there is less wasted space in the struct.
OK.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply
* Re: skb_linearize
From: Ben Hutchings @ 2012-10-31 21:03 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: netdev, Herbert Xu
In-Reply-To: <20121031191530.GA3674@redhat.com>
On Wed, 2012-10-31 at 21:15 +0200, Michael S. Tsirkin wrote:
> On Sun, Sep 16, 2012 at 04:07:12PM +0100, Ben Hutchings wrote:
> > On Sun, 2012-09-16 at 12:17 +0300, Michael S. Tsirkin wrote:
> > > I notice that dev_hard_start_xmit might invoke
> > > __skb_linearize e.g. if device does not support NETIF_F_SG.
> > >
> > > This in turn onvokes __pskb_pull_tail, and
> > > documentation of __pskb_pull_tail says:
> > > &sk_buff MUST have reference count of 1.
> > >
> > > I am guessing 'reference count' means users in this context, right?
> > > IIUC this is because it modifies skb in a way that
> > > isn't safe if anyone else is looking at the skb.
> > >
> > >
> > > However, I don't see what guarantees that reference
> > > count is 1 when dev_hard_start_xmit invokes
> > > linearize. In particular it calls dev_queue_xmit_nit
> > > which could queue packets on a network tap.
> > >
> > > Could someone help me understand please?
> >
> > Reference count here means references to struct sk_buff itself. The
> > header area and data fragments are allowed to be shared.
> >
> > dev_queue_xmit_nit() clones the skb for each tap, so the reference count
> > on the original skb remains 1.
> >
> > Ben.
>
> Interesting. But don't skb clones share the fragment list?
Yes.
> Maybe I misunderstand? If they do it looks like the following race
> would be possible:
>
> - skb is cloned and queued e.g. at socket receive queue.
> dataref becomes 2.
> - On CPU 1, skb_copy_datagram_iovec is called on clone 1, is reads nr_frags and sees
> value > 1.
> - On CPU 2, __skb_linearize is now called on clone 2, it modified the
> skb so nr_frags is now 0, and does put_page for all frags > 1.
> - On CPU 1, skb_copy_datagram_iovec will now use the previously read
> nr_frags > 1 and access a fragment page that was already freed.
>
> What did I miss?
__skb_linearize() calls __pskb_pull_tail(), which starts with:
if (eat > 0 || skb_cloned(skb)) {
if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0,
GFP_ATOMIC))
return NULL;
}
pskb_expand_head() will then create a new unshared head area for the skb
being linearised, and will add a reference to each fragment page
(skb_frag_ref()). __pskb_pull_tail() unreferences the pages later, as
you say, but this all cancels out.
(pskb_expand_head() will also cancel zero-copy (skb_orphan_frags() ->
skb_copy_ubufs()), which seems like it should be done only after the
head area has been unshared. But skb_clone() will also do that, so I
don't know how the zero-copy flag would still be set on a cloned skb.)
Ben.
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: [PATCH net-next 3/8] bridge: implement BPDU blocking
From: Stephen Hemminger @ 2012-10-31 20:57 UTC (permalink / raw)
To: Cong Wang; +Cc: netdev
In-Reply-To: <k6q2vm$1ug$1@ger.gmane.org>
On Wed, 31 Oct 2012 02:38:46 +0000 (UTC)
Cong Wang <xiyou.wangcong@gmail.com> wrote:
> On Tue, 30 Oct 2012 at 00:57 GMT, Stephen Hemminger <shemminger@vyatta.com> wrote:
> > --- a/net/bridge/br_stp_bpdu.c 2012-10-29 17:07:08.005982838 -0700
> > +++ b/net/bridge/br_stp_bpdu.c 2012-10-29 17:31:14.327457434 -0700
> > @@ -170,6 +170,13 @@ void br_stp_rcv(const struct stp_proto *
> > if (!ether_addr_equal(dest, br->group_addr))
> > goto out;
> >
> > + if (p->flags & BR_BPDU_GUARD) {
> > + br_notice(br, "BPDU received on blocked port %u(%s)\n",
> > + (unsigned int) p->port_no, p->dev->name);
>
> net_ratelimit() ?
>
Not necessary since this causes port of bridge to become disabled;
which blocks all further packets (including STP) until manually reset.
^ permalink raw reply
* Re: [PATCH net-next] sockopt: Change getsockopt() of SO_BINDTODEVICE to return an interface name
From: Andi Kleen @ 2012-10-31 20:47 UTC (permalink / raw)
To: Brian Haley
Cc: David Miller, Pavel Emelyanov, Eric Dumazet,
netdev@vger.kernel.org
In-Reply-To: <509184D9.8030103@hp.com>
Brian Haley <brian.haley@hp.com> writes:
> Instead of having the getsockopt() of SO_BINDTODEVICE return an index, which
> will then require another call like if_indextoname() to get the actual interface
> name, have it return the name directly.
>
> This also matches the existing man page description on socket(7) which mentions
> the argument being an interface name.
>
> If the value has not been set, zero is returned and optlen will be set to zero
> to indicate there is no interface name present.
That will break all existing programs using the return value, right?
Better to fix the manpage
-Andi
--
ak@linux.intel.com -- Speaking for myself only
^ permalink raw reply
* Fw: [Bug 42764] BUG at net/core/skbuff.c:147
From: Stephen Hemminger @ 2012-10-31 20:51 UTC (permalink / raw)
To: Michael Chan; +Cc: netdev
Begin forwarded message:
Date: Wed, 31 Oct 2012 08:55:31 +0000 (UTC)
From: bugzilla-daemon@bugzilla.kernel.org
To: shemminger@linux-foundation.org
Subject: [Bug 42764] BUG at net/core/skbuff.c:147
https://bugzilla.kernel.org/show_bug.cgi?id=42764
Guido Aulisi <guido.aulisi@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |guido.aulisi@gmail.com
--- Comment #3 from Guido Aulisi <guido.aulisi@gmail.com> 2012-10-31 08:55:31 ---
I got it one more time. Ethernet card is:
0e:00.0 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709S Gigabit
Ethernet (rev 20)
ethtool -i eth0
driver: bnx2
version: 2.1.6
firmware-version: bc 4.4.14 IPMI 0.1.16
bus-info: 0000:04:00.0
ethtool -i eth2
driver: bnx2
version: 2.1.6
firmware-version: bc 4.4.10
bus-info: 0000:0e:00.0
Could this be related to an old firmware?
This machine does a lot of network traffic, because it load data from a
database every night.
Kernel version is 3.0.34
Sorry for not reporting hardware, I thought it was a protocol bug not related
to a specific card.
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:147!
invalid opcode: 0000 [#1] SMP
CPU 2
Modules linked in: af_packet ipmi_devintf ipmi_si ipmi_msghandler ipv6 fuse
loop sr_mod cdrom mptsas mptscsih mptbase scsi_transport_sas tpm_tis tpm bnx2
tpm_bios sg i2c_piix4 i2c_core shpchp pci_hotplug button serio_raw linear
scsi_dh_alua scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc dm_round_robin sd_mod
crc_t10dif qla2xxx scsi_transport_fc scsi_tgt dm_snapshot dm_multipath scsi_dh
scsi_mod edd dm_mod ext3 mbcache jbd fan thermal processor thermal_sys hwmon
[last unloaded: usbcore]
Pid: 21566, comm: nscd Not tainted 3.0.34-inps #5 IBM BladeCenter LS42
-[7902CQG]-/Server Blade
RIP: 0010:[<ffffffff8123fd12>] [<ffffffff8123fd12>] skb_push+0x75/0x7e
RSP: 0018:ffff880b956c39d8 EFLAGS: 00010292
RAX: 0000000000000083 RBX: 0000000000000800 RCX: 0000000000023382
RDX: 0000000000007878 RSI: 0000000000000046 RDI: ffffffff8152ee9c
RBP: ffff880b956c39f8 R08: 0000000000000000 R09: 0720072007200720
R10: ffff880b956c37c8 R11: 0720072007200720 R12: 0000000000000000
R13: ffff8810231fb718 R14: 0000000000000055 R15: ffff880c25d24000
FS: 00007fd9a9222950(0000) GS:ffff880c3fc00000(0000) knlGS:00000000e8dafb90
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007fd9b403a000 CR3: 0000000c265e8000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process nscd (pid: 21566, threadinfo ffff880b956c2000, task ffff8803e50e4790)
Stack:
0000000000000057 0000000000000080 ffff880c25d24000 ffff880c71806440
ffff880b956c3a38 ffffffff8125e0c5 ffff880b956c3a28 0000000000000036
ffff8810231fb680 ffff8810231fb718 ffff880b2cc49380 ffff8810231fb710
Call Trace:
[<ffffffff8125e0c5>] eth_header+0x29/0xa8
[<ffffffff81251a59>] neigh_resolve_output+0x284/0x2ed
[<ffffffff8127575e>] ip_finish_output+0x24c/0x293
[<ffffffff81097cac>] ? zone_watermark_ok+0x1a/0x1c
[<ffffffff81275846>] ip_output+0xa1/0xa5
[<ffffffff81274b92>] ip_local_out+0x24/0x29
[<ffffffff81274ba0>] ip_send_skb+0x9/0x4c
[<ffffffff8129178b>] udp_send_skb+0x28b/0x2e8
[<ffffffff812935cb>] udp_sendmsg+0x501/0x708
[<ffffffff810e42dd>] ? poll_freewait+0x8d/0x8d
[<ffffffff812740ec>] ? ip_append_page+0x4f4/0x4f4
[<ffffffff8109b8f2>] ? __alloc_pages_nodemask+0x731/0x77c
[<ffffffff810541ad>] ? sched_clock_local+0x1c/0x80
[<ffffffff81299607>] inet_sendmsg+0x83/0x90
[<ffffffff81238e93>] sock_sendmsg+0xe3/0x106
[<ffffffff810c7c8a>] ? ____cache_alloc_node+0x4c/0x132
[<ffffffff810c7b4f>] ? fallback_alloc+0xe1/0x1d0
[<ffffffff8126e390>] ? __ip_route_output_key+0x139/0x816
[<ffffffff812d24e3>] ? _raw_spin_unlock_bh+0xf/0x11
[<ffffffff8123ba9e>] ? release_sock+0xfd/0x106
[<ffffffff81239463>] sys_sendto+0xfa/0x123
[<ffffffff81239c3d>] ? sys_connect+0x88/0x9c
[<ffffffff812d78bb>] system_call_fastpath+0x16/0x1b
Code: 8b 57 68 48 89 44 24 10 8b 87 d0 00 00 00 48 89 44 24 08 8b bf cc 00 00
00 31 c0 48 89 3c 24 48 c7 c7 5a 79 3a 81 e8 df 03 09 00 <0f> 0b eb fe 48 89 c8
c9 c3 55 89 f1 48 89 e5 48 83 ec 20 83 7f
RIP [<ffffffff8123fd12>] skb_push+0x75/0x7e
RSP <ffff880b956c39d8>
---[ end trace 7e8c514a1c33a3f0 ]---
Output of lspci -vvv:
0e:00.0 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709S Gigabit
Ethernet (rev 20)
Subsystem: IBM Device 039f
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+
Stepping- SERR+ FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 26
Region 0: Memory at ce000000 (64-bit, non-prefetchable) [size=32M]
Capabilities: [48] Power Management version 3
Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA
PME(D0+,D1-,D2-,D3hot+,D3cold+)
Status: D0 PME-Enable- DSel=0 DScale=1 PME-
Capabilities: [50] Vital Product Data <?>
Capabilities: [58] Message Signalled Interrupts: Mask- 64bit+ Count=1/8
Enable-
Address: 0000000000000000 Data: 0000
Capabilities: [a0] MSI-X: Enable+ Mask- TabSize=9
Vector table: BAR=0 offset=0000c000
PBA: BAR=0 offset=0000e000
Capabilities: [ac] Express (v2) Endpoint, MSI 00
DevCap: MaxPayload 512 bytes, PhantFunc 0, Latency L0s <4us, L1
<64us
ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset-
DevCtl: Report errors: Correctable- Non-Fatal+ Fatal+ Unsupported-
RlxdOrd+ ExtTag- PhantFunc- AuxPwr+ NoSnoop+
MaxPayload 256 bytes, MaxReadReq 4096 bytes
DevSta: CorrErr+ UncorrErr- FatalErr- UnsuppReq+ AuxPwr+ TransPend-
LnkCap: Port #0, Speed 2.5GT/s, Width x4, ASPM L0s L1, Latency L0
<4us, L1 <4us
ClockPM- Suprise- LLActRep- BwNot-
LnkCtl: ASPM Disabled; RCB 128 bytes Disabled- Retrain- CommClk-
ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
LnkSta: Speed 2.5GT/s, Width x4, TrErr- Train- SlotClk+ DLActive-
BWMgmt- ABWMgmt-
DevCap2: Completion Timeout: Range ABCD, TimeoutDis+
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis+
LnkCtl2: Target Link Speed: 2.5GT/s, EnterCompliance- SpeedDis-,
Selectable De-emphasis: -6dB
Transmit Margin: Normal Operating Range, EnterModifiedCompliance-
ComplianceSOS-
Compliance De-emphasis: -6dB
LnkSta2: Current De-emphasis Level: -6dB
Kernel driver in use: bnx2
Kernel modules: bnx2
0e:00.1 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709S Gigabit
Ethernet (rev 20)
Subsystem: IBM Device 039f
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr+
Stepping- SERR+ FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin B routed to IRQ 26
Region 0: Memory at d0000000 (64-bit, non-prefetchable) [size=32M]
Capabilities: [48] Power Management version 3
Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA
PME(D0+,D1-,D2-,D3hot+,D3cold+)
Status: D0 PME-Enable- DSel=0 DScale=1 PME-
Capabilities: [50] Vital Product Data <?>
Capabilities: [58] Message Signalled Interrupts: Mask- 64bit+ Count=1/8
Enable-
Address: 0000000000000000 Data: 0000
Capabilities: [a0] MSI-X: Enable- Mask- TabSize=8
Vector table: BAR=0 offset=0000c000
PBA: BAR=0 offset=0000e000
Capabilities: [ac] Express (v2) Endpoint, MSI 00
DevCap: MaxPayload 512 bytes, PhantFunc 0, Latency L0s <4us, L1
<64us
ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset-
DevCtl: Report errors: Correctable- Non-Fatal+ Fatal+ Unsupported-
RlxdOrd+ ExtTag- PhantFunc- AuxPwr+ NoSnoop+
MaxPayload 256 bytes, MaxReadReq 4096 bytes
DevSta: CorrErr+ UncorrErr- FatalErr- UnsuppReq+ AuxPwr+ TransPend-
LnkCap: Port #0, Speed 2.5GT/s, Width x4, ASPM L0s L1, Latency L0
<4us, L1 <4us
ClockPM- Suprise- LLActRep- BwNot-
LnkCtl: ASPM Disabled; RCB 128 bytes Disabled- Retrain- CommClk-
ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
LnkSta: Speed 2.5GT/s, Width x4, TrErr- Train- SlotClk+ DLActive-
BWMgmt- ABWMgmt-
DevCap2: Completion Timeout: Range ABCD, TimeoutDis+
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis+
LnkCtl2: Target Link Speed: 2.5GT/s, EnterCompliance- SpeedDis-,
Selectable De-emphasis: -6dB
Transmit Margin: Normal Operating Range, EnterModifiedCompliance-
ComplianceSOS-
Compliance De-emphasis: -6dB
LnkSta2: Current De-emphasis Level: -6dB
Kernel driver in use: bnx2
Kernel modules: bnx2
--
Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
^ permalink raw reply
* Re: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois
From: Stephen Hemminger @ 2012-10-31 20:48 UTC (permalink / raw)
To: Jesper Dangaard Brouer
Cc: David S. Miller, netdev, Petr Matousek, Eric Dumazet
In-Reply-To: <20121031124318.30915.32293.stgit@dragon>
On Wed, 31 Oct 2012 13:45:32 +0100
Jesper Dangaard Brouer <brouer@redhat.com> wrote:
> Reading TCP stats when using TCP Illinois congestion control algorithm
> can cause a divide by zero kernel oops.
>
> The division by zero occur in tcp_illinois_info() at:
> do_div(t, ca->cnt_rtt);
> where ca->cnt_rtt can become zero (when rtt_reset is called)
>
> Steps to Reproduce:
> 1. Register tcp_illinois:
> # sysctl -w net.ipv4.tcp_congestion_control=illinois
> 2. Monitor internal TCP information via command "ss -i"
> # watch -d ss -i
> 3. Establish new TCP conn to machine
>
> Either it fails at the initial conn, or else it needs to wait
> for a loss or a reset.
>
> This is only related to reading stats. The function avg_delay() also
> performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
> calling point in update_params(). Thus, simply fix tcp_illinois_info().
>
> Function tcp_illinois_info() / get_info() is called without
> socket lock. Thus, eliminate any race condition on ca->cnt_rtt
> by using a local stack variable. Simply reuse info.tcpv_rttcnt,
> as its already set to ca->cnt_rtt.
> Function avg_delay() is not affected by this race condition, as
> its called with the socket lock.
>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
>
> ---
> V2:
> Address Eric Dumazets input:
> - Save 2 bytes of stack, by using info.tcpv_rttcnt.
> - Help compiler, and define "u64 t" inside if() lexical scope.
>
>
> net/ipv4/tcp_illinois.c | 8 +++++---
> 1 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
> index 813b43a..834857f 100644
> --- a/net/ipv4/tcp_illinois.c
> +++ b/net/ipv4/tcp_illinois.c
> @@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
> .tcpv_rttcnt = ca->cnt_rtt,
> .tcpv_minrtt = ca->base_rtt,
> };
> - u64 t = ca->sum_rtt;
>
> - do_div(t, ca->cnt_rtt);
> - info.tcpv_rtt = t;
> + if (info.tcpv_rttcnt > 0) {
> + u64 t = ca->sum_rtt;
>
> + do_div(t, info.tcpv_rttcnt);
> + info.tcpv_rtt = t;
> + }
> nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
> }
> }
>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
^ permalink raw reply
* [PATCH net-next] sockopt: Change getsockopt() of SO_BINDTODEVICE to return an interface name
From: Brian Haley @ 2012-10-31 20:06 UTC (permalink / raw)
To: David Miller; +Cc: Pavel Emelyanov, Eric Dumazet, netdev@vger.kernel.org
Instead of having the getsockopt() of SO_BINDTODEVICE return an index, which
will then require another call like if_indextoname() to get the actual interface
name, have it return the name directly.
This also matches the existing man page description on socket(7) which mentions
the argument being an interface name.
If the value has not been set, zero is returned and optlen will be set to zero
to indicate there is no interface name present.
Signed-off-by: Brian Haley <brian.haley@hp.com>
--
diff --git a/net/core/sock.c b/net/core/sock.c
index 0a023b8..9172ff4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -505,7 +505,8 @@ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie)
}
EXPORT_SYMBOL(sk_dst_check);
-static int sock_bindtodevice(struct sock *sk, char __user *optval, int optlen)
+static int sock_setbindtodevice(struct sock *sk, char __user *optval,
+ int optlen)
{
int ret = -ENOPROTOOPT;
#ifdef CONFIG_NETDEVICES
@@ -562,6 +563,52 @@ out:
return ret;
}
+static int sock_getbindtodevice(struct sock *sk, char __user *optval,
+ int __user *optlen, int len)
+{
+ int ret = -ENOPROTOOPT;
+#ifdef CONFIG_NETDEVICES
+ struct net *net = sock_net(sk);
+ struct net_device *dev;
+ char devname[IFNAMSIZ];
+
+ if (sk->sk_bound_dev_if == 0) {
+ len = 0;
+ goto zero;
+ }
+
+ ret = -EINVAL;
+ if (len < IFNAMSIZ)
+ goto out;
+
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
+ if (dev)
+ strcpy(devname, dev->name);
+ rcu_read_unlock();
+ ret = -ENODEV;
+ if (!dev)
+ goto out;
+
+ len = strlen(devname) + 1;
+
+ ret = -EFAULT;
+ if (copy_to_user(optval, devname, len))
+ goto out;
+
+zero:
+ ret = -EFAULT;
+ if (put_user(len, optlen))
+ goto out;
+
+ ret = 0;
+
+out:
+#endif
+
+ return ret;
+}
+
static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
{
if (valbool)
@@ -589,7 +636,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
*/
if (optname == SO_BINDTODEVICE)
- return sock_bindtodevice(sk, optval, optlen);
+ return sock_setbindtodevice(sk, optval, optlen);
if (optlen < sizeof(int))
return -EINVAL;
@@ -1074,9 +1121,10 @@ int sock_getsockopt(struct socket *sock, int level, int
optname,
case SO_NOFCS:
v.val = sock_flag(sk, SOCK_NOFCS);
break;
+
case SO_BINDTODEVICE:
- v.val = sk->sk_bound_dev_if;
- break;
+ return sock_getbindtodevice(sk, optval, optlen, len);
+
default:
return -ENOPROTOOPT;
}
^ permalink raw reply related
* Re: [PATCH v2 2/3] pppoatm: fix race condition with destroying of vcc
From: chas williams - CONTRACTOR @ 2012-10-31 20:03 UTC (permalink / raw)
To: Krzysztof Mazur; +Cc: davem, dwmw2, netdev, linux-kernel
In-Reply-To: <20121031094147.GA1004@shrek.podlesie.net>
On Wed, 31 Oct 2012 10:41:47 +0100
Krzysztof Mazur <krzysiek@podlesie.net> wrote:
> On Tue, Oct 30, 2012 at 07:20:01PM +0100, Krzysztof Mazur wrote:
> > Yes, this problem can be probably fixed by reversing close and push
> > and adding some synchronization to pppoatm_unassign_vcc(), but I think
> > we need that locking anyway, for instance for synchronization for
> > checking and incrementing sk->sk_wmem_alloc, between pppoatm_send()
> > and vcc_sendmsg().
> >
>
> I think that the same problem exists in other drivers (net/atm/br2684.c,
> net/atm/clip.c, maybe other).
>
> Reversing order of close() and push(vcc, NULL) operations seems to
> be a good idea, but synchronization with push(vcc, NULL)
> and function that calls vcc->send() must be added to all drivers.
this was the scheme that was (and is) currently in place. detaching a
protocol from the atm layer never had a separate function, so it was
decided at some point to just push a NULL skb as a signal to the next
layer that i needed to cleanly shutdown and detach. the push(vcc,
NULL) always happens in a sleepable context, so waiting for whatever
attached protocol scheduler to finish up is not a problem. after the
pushing of the skb NULL, the attached protocol should not send or recv
any data on that vcc.
reversing the order of the push and close certainly seems like the right
thing to do. i would like to see if it would fix your problem. making
the minimal change to get something working would be preferred before
adding additional complexity. i am just surprised we havent seen this
bug before.
> I think it's better to just use ATM socket lock - lock_sock(sk_atm(vcc)),
> it will fix also problems with synchronization with vcc_sendmsg()
> and possibly other functions (ioctl?).
>
> I think that we should add a wrapper to vcc->send(), based on
> fixed pppoatm_send(), that performs required checks and takes the ATM socket
> lock.
>
> But I think we should reverse those operations anyway, because some
> drivers may use other locks, not ATM socket lock, for proper
> synchronization.
i dont think this is a bad idea. vcc_release_async() could happen
(this would be a bit unusual for a pvc but removing the usbatm device
would do this) and there is no point in sending on a vcc that is
closing.
^ permalink raw reply
* RE: [PATCH 4/4] arm/dts: am33xx: Add CPSW and MDIO module nodes for AM33XX
From: Hiremath, Vaibhav @ 2012-10-31 19:52 UTC (permalink / raw)
To: Cousson, Benoit
Cc: netdev@vger.kernel.org, paul@pwsan.com,
linux-arm-kernel@lists.infradead.org, linux-omap@vger.kernel.org,
N, Mugunthan V, Richard Cochran
In-Reply-To: <50914107.2090909@ti.com>
On Wed, Oct 31, 2012 at 20:47:27, Cousson, Benoit wrote:
> Hi,
>
> On 10/29/2012 09:21 AM, Vaibhav Hiremath wrote:
> > From: Mugunthan V N <mugunthanvnm@ti.com>
> >
> > Add CPSW and MDIO related device tree data for AM33XX.
> > Also enable them into board/evm dts files by providing
> > respective phy-id.
>
> Is there any bindings documentation for that device?
>
Yes, the base DT binding documentation is present in file
Documentation/devicetree/bindings/net/cpsw.txt
> > Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
> > Signed-off-by: Vaibhav Hiremath <hvaibhav@ti.com>
> > Cc: Richard Cochran <richardcochran@gmail.com>
> > Cc: Benoit Cousson <b-cousson@ti.com>
> > ---
> > arch/arm/boot/dts/am335x-bone.dts | 8 ++++++
> > arch/arm/boot/dts/am335x-evm.dts | 8 ++++++
> > arch/arm/boot/dts/am33xx.dtsi | 50 +++++++++++++++++++++++++++++++++++++
> > 3 files changed, 66 insertions(+), 0 deletions(-)
> >
> > diff --git a/arch/arm/boot/dts/am335x-bone.dts b/arch/arm/boot/dts/am335x-bone.dts
> > index c634f87..e233cfa 100644
> > --- a/arch/arm/boot/dts/am335x-bone.dts
> > +++ b/arch/arm/boot/dts/am335x-bone.dts
> > @@ -78,3 +78,11 @@
> > };
> > };
> > };
> > +
> > +&cpsw_emac0 {
> > + phy_id = "4a101000.mdio:00";
>
> Why are you using that kind of interface? You seem to want a reference
> to a device.
>
> Cannot you have something less hard coded like:
> phy_id = <&davinci_mdio>, <0>;
>
>
> > +};
> > +
> > +&cpsw_emac1 {
> > + phy_id = "4a101000.mdio:01";
> > +};
> > diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
> > index 185d632..415c3b3 100644
> > --- a/arch/arm/boot/dts/am335x-evm.dts
> > +++ b/arch/arm/boot/dts/am335x-evm.dts
> > @@ -118,3 +118,11 @@
> > };
> > };
> > };
> > +
> > +&cpsw_emac0 {
> > + phy_id = "4a101000.mdio:00";
> > +};
> > +
> > +&cpsw_emac1 {
> > + phy_id = "4a101000.mdio:01";
> > +};
> > diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
> > index bb31bff..f6bea04 100644
> > --- a/arch/arm/boot/dts/am33xx.dtsi
> > +++ b/arch/arm/boot/dts/am33xx.dtsi
> > @@ -210,5 +210,55 @@
> > interrupt-parent = <&intc>;
> > interrupts = <91>;
> > };
> > +
> > + mac: ethernet@4A100000 {
>
> hexa data should be in lower case.
>
Oops. Will correct it.
> > + compatible = "ti,cpsw";
> > + ti,hwmods = "cpgmac0";
> > + cpdma_channels = <8>;
> > + host_port_no = <0>;
> > + cpdma_reg_ofs = <0x800>;
> > + cpdma_sram_ofs = <0xa00>;
> > + ale_reg_ofs = <0xd00>;
> > + ale_entries = <1024>;
> > + host_port_reg_ofs = <0x108>;
> > + hw_stats_reg_ofs = <0x900>;
> > + bd_ram_ofs = <0x2000>;
> > + bd_ram_size = <0x2000>;
> > + no_bd_ram = <0>;
> > + rx_descs = <64>;
> > + mac_control = <0x20>;
>
> Do you have to store all these data in the DTS? Cannot it be in the driver?
>
> Do you expect to have several instance of the same IP with different
> parameters here?
>
I will let Mugunthan respond to this.
> > + slaves = <2>;
> > + reg = <0x4a100000 0x800
> > + 0x4a101200 0x100
> > + 0x4a101000 0x100>;
>
> Please align the address.
Ok.
>
> > + #address-cells = <1>;
> > + #size-cells = <1>;
> > + interrupt-parent = <&intc>;
> > + /* c0_rx_thresh_pend c0_rx_pend c0_tx_pend c0_misc_pend*/
>
> Please use a standard multi-line comment instead of trying to put
> everything in one line.
>
Oops. Will correct it.
> > + interrupts = <40 41 42 43>;
> > + ranges;
>
> You should add blank line here for readability.
>
OK.
> > + cpsw_emac0: slave@0 {
>
> Mmm, you are using some address later and here some relative number,
> that does not looks very consistent.
>
> > + slave_reg_ofs = <0x208>;
>
> Is it an offset from 4a100000? Cannot you use the address for the slave
> name?
>
> Something like that: cpsw_emac0: slave@4a100208
>
> > + sliver_reg_ofs = <0xd80>;
> > + /* Filled in by U-Boot */
> > + mac-address = [ 00 00 00 00 00 00 ];
> > + };
>
> You should add blank line here for readability.
>
Ok
Thanks,
Vaibhav
^ permalink raw reply
* Re: skb_linearize
From: Michael S. Tsirkin @ 2012-10-31 19:15 UTC (permalink / raw)
To: Ben Hutchings; +Cc: netdev, Herbert Xu
In-Reply-To: <1347808032.13258.275.camel@deadeye.wl.decadent.org.uk>
On Sun, Sep 16, 2012 at 04:07:12PM +0100, Ben Hutchings wrote:
> On Sun, 2012-09-16 at 12:17 +0300, Michael S. Tsirkin wrote:
> > I notice that dev_hard_start_xmit might invoke
> > __skb_linearize e.g. if device does not support NETIF_F_SG.
> >
> > This in turn onvokes __pskb_pull_tail, and
> > documentation of __pskb_pull_tail says:
> > &sk_buff MUST have reference count of 1.
> >
> > I am guessing 'reference count' means users in this context, right?
> > IIUC this is because it modifies skb in a way that
> > isn't safe if anyone else is looking at the skb.
> >
> >
> > However, I don't see what guarantees that reference
> > count is 1 when dev_hard_start_xmit invokes
> > linearize. In particular it calls dev_queue_xmit_nit
> > which could queue packets on a network tap.
> >
> > Could someone help me understand please?
>
> Reference count here means references to struct sk_buff itself. The
> header area and data fragments are allowed to be shared.
>
> dev_queue_xmit_nit() clones the skb for each tap, so the reference count
> on the original skb remains 1.
>
> Ben.
Interesting. But don't skb clones share the fragment list?
Maybe I misunderstand? If they do it looks like the following race
would be possible:
- skb is cloned and queued e.g. at socket receive queue.
dataref becomes 2.
- On CPU 1, skb_copy_datagram_iovec is called on clone 1, is reads nr_frags and sees
value > 1.
- On CPU 2, __skb_linearize is now called on clone 2, it modified the
skb so nr_frags is now 0, and does put_page for all frags > 1.
- On CPU 1, skb_copy_datagram_iovec will now use the previously read
nr_frags > 1 and access a fragment page that was already freed.
What did I miss?
> --
> Ben Hutchings, Staff Engineer, Solarflare
> Not speaking for my employer; that's the marketing department's job.
> They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: pull request: wireless 2012-10-31
From: David Miller @ 2012-10-31 18:59 UTC (permalink / raw)
To: linville; +Cc: linux-wireless, netdev, linux-kernel
In-Reply-To: <20121031173740.GB30910@tuxdriver.com>
From: "John W. Linville" <linville@tuxdriver.com>
Date: Wed, 31 Oct 2012 13:37:40 -0400
> The biggest portion of this is a pull request from Johannes Berg:
>
> "Please pull my mac80211.git tree per below to get a number of fixes. I
> have included a patch from Antonio to fix a memcpy overrun, Felix's
> patches for the antenna gain/tx power issues, a few mesh-related fixes
> from Javier for mac80211 and my own patches to not access data that
> might not be present in an skb at all as well as a patch (the duplicate
> IE check one) to make mac80211 forward-compatible with potential future
> spec extensions that use the same IE multiple times.
>
> It's a bit bigger than I'd like maybe, but I think all of these are
> worthwhile fixes at this point."
>
> In addition...
>
> Felix Fietkau fixes an ath9k use-after-free issue.
>
> Stanislaw Gruszka adds a valid value check to rt2800.
>
> Sven Eckelmann adds a check to only check a TID value in a BlockAck, for
> frames that could be either a BlockAck or a normal Ack.
Pulled, thanks John.
^ permalink raw reply
* Re: [PATCH 0/3] netfilter updates for the net tree
From: David Miller @ 2012-10-31 18:57 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
In-Reply-To: <1351592360-5686-1-git-send-email-pablo@netfilter.org>
From: pablo@netfilter.org
Date: Tue, 30 Oct 2012 11:19:17 +0100
> The following patchset contains fixes for your net tree, two of them
> are due to relatively recent changes, one has been a longstanding bug,
> they are:
>
> * Fix incorrect usage of rt_gateway in the H.323 helper, from
> Julian Anastasov.
>
> * Skip re-route in nf_nat code for ICMP traffic. If CONFIG_XFRM is
> enabled, we waste cycles to look up for the route again. This problem
> seems to be there since really long time. From Ulrich Weber.
>
> * Fix mismatching section in nf_conntrack_reasm, from Hein Tibosch.
>
> You can pull this changes from:
>
> git://1984.lsi.us.es/nf master
Pulled, thanks.
^ permalink raw reply
* Re: [net-next 00/13][pull request] Intel Wired LAN Driver Updates
From: David Miller @ 2012-10-31 18:28 UTC (permalink / raw)
To: jeffrey.t.kirsher; +Cc: netdev, gospo, sassmann
In-Reply-To: <1351580670-8292-1-git-send-email-jeffrey.t.kirsher@intel.com>
From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Date: Tue, 30 Oct 2012 00:04:17 -0700
> This series contains updates to ixgbe, ixgbevf, igbvf, igb and
> networking core (bridge). Most notably is the addition of support
> for local link multicast addresses in SR-IOV mode to the networking
> core.
>
> Also note, the ixgbe patch "ixgbe: Add support for pipeline reset" and
> "ixgbe: Fix return value from macvlan filter function" is revised based
> on community feedback.
Pulled, thanks Jeff.
^ permalink raw reply
* Re: [net-next resend v4 5/7] tuntap: multiqueue support
From: David Miller @ 2012-10-31 18:16 UTC (permalink / raw)
To: jasowang
Cc: mst, netdev, linux-kernel, maxk, edumazet, krkumar2,
ernesto.martin, haixiao
In-Reply-To: <1351491351-11477-6-git-send-email-jasowang@redhat.com>
From: Jason Wang <jasowang@redhat.com>
Date: Mon, 29 Oct 2012 14:15:49 +0800
> @@ -110,6 +110,11 @@ struct tap_filter {
> unsigned char addr[FLT_EXACT_COUNT][ETH_ALEN];
> };
>
> +/* 1024 is probably a high enough limit: modern hypervisors seem to support on
> + * the order of 100-200 CPUs so this leaves us some breathing space if we want
> + * to match a queue per guest CPU. */
Please don't format comments like this. Put that final "*/" on it's
own line.
I'm really perplexed how you can get it right elsewhere in your
patches, and then botch it up only in a few select locations :-/
> +/* We try to identify a flow through its rxhash first. The reason that
> + * we do not check rxq no. is becuase some cards(e.g 82599), chooses
> + * the rxq based on the txq where the last packet of the flow comes. As
> + * the userspace application move between processors, we may get a
> + * different rxq no. here. If we could not get rxhash, then we would
> + * hope the rxq no. may help here.
> + */
For example, this one is done right.
^ permalink raw reply
* Re: [PATCH] tcp: make tcp_clear_md5_list static
From: David Miller @ 2012-10-31 18:05 UTC (permalink / raw)
To: shemminger; +Cc: netdev
In-Reply-To: <20121026173140.54fb1f6f@nehalam.linuxnetplumber.net>
From: Stephen Hemminger <shemminger@vyatta.com>
Date: Fri, 26 Oct 2012 17:31:40 -0700
> Trivial. Only used in one file.
>
> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next] net: compute skb->rxhash if nic hash may be 3-tuple
From: David Miller @ 2012-10-31 18:04 UTC (permalink / raw)
To: willemb; +Cc: edumazet, netdev
In-Reply-To: <1351288328-30147-1-git-send-email-willemb@google.com>
Applied.
^ permalink raw reply
* Re: [PATCH] dlink: dl2k: use the module_pci_driver macro
From: David Miller @ 2012-10-31 18:04 UTC (permalink / raw)
To: devendra.aaru; +Cc: romieu, netdev
In-Reply-To: <1351279740-16519-1-git-send-email-devendra.aaru@gmail.com>
From: Devendra Naga <devendra.aaru@gmail.com>
Date: Fri, 26 Oct 2012 15:29:00 -0400
> use the module_pci_driver macro to make the code simpler
> by eliminating module_init and module_exit calls.
>
> Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH] realtek: r8169: use module_pci_driver macro
From: David Miller @ 2012-10-31 18:04 UTC (permalink / raw)
To: devendra.aaru; +Cc: romieu, netdev
In-Reply-To: <1351279662-16466-1-git-send-email-devendra.aaru@gmail.com>
From: Devendra Naga <devendra.aaru@gmail.com>
Date: Fri, 26 Oct 2012 15:27:42 -0400
> use the module_pci_driver macro to make the code simpler
> by eliminating the module_init and module_exit calls
>
> Signed-off-by: Devendra Naga <devendra.aaru@gmail.com>
Applied.
^ permalink raw reply
* Re: pull request: batman-adv 202-10-29
From: David Miller @ 2012-10-31 17:53 UTC (permalink / raw)
To: ordex; +Cc: netdev, b.a.t.m.a.n
In-Reply-To: <1351501097-1289-1-git-send-email-ordex@autistici.org>
From: Antonio Quartulli <ordex@autistici.org>
Date: Mon, 29 Oct 2012 09:58:01 +0100
> this is again our first set of changes intended for net-next/linux-3.8.
> With respect to the previous changeset we substituted the patch changing the
> BAT_ATTR_HIF_UINT macro with a new one that removes it (we will re-add such
> macro together with the user).
> The rest is exactly the same as before.
Pulled, thanks.
^ permalink raw reply
* pull request: wireless 2012-10-31
From: John W. Linville @ 2012-10-31 17:37 UTC (permalink / raw)
To: davem; +Cc: linux-wireless, netdev, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 17177 bytes --]
commit 06272911485850b4a336122958c50af0f8ea7c13
Dave,
This is a batch of fixes intended for 3.7...
The biggest portion of this is a pull request from Johannes Berg:
"Please pull my mac80211.git tree per below to get a number of fixes. I
have included a patch from Antonio to fix a memcpy overrun, Felix's
patches for the antenna gain/tx power issues, a few mesh-related fixes
from Javier for mac80211 and my own patches to not access data that
might not be present in an skb at all as well as a patch (the duplicate
IE check one) to make mac80211 forward-compatible with potential future
spec extensions that use the same IE multiple times.
It's a bit bigger than I'd like maybe, but I think all of these are
worthwhile fixes at this point."
In addition...
Felix Fietkau fixes an ath9k use-after-free issue.
Stanislaw Gruszka adds a valid value check to rt2800.
Sven Eckelmann adds a check to only check a TID value in a BlockAck, for
frames that could be either a BlockAck or a normal Ack.
Please let me know if there are problems!
John
P.S. Stay safe in NYC! It must be tough there right now. Let me know
if I can somehow be helpful to you! Anyway, I wanted to go ahead and
post this now for when you do find the means to process pull requests.
If you would prefer that I do something else, then please let me know!
---
The following changes since commit e657e078d3dfa9f96976db7a2b5fd7d7c9f1f1a6:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2012-10-26 15:00:48 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git for-davem
for you to fetch changes up to 06272911485850b4a336122958c50af0f8ea7c13:
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem (2012-10-31 13:10:01 -0400)
----------------------------------------------------------------
Antonio Quartulli (1):
mac80211: fix SSID copy on IBSS JOIN
Felix Fietkau (3):
cfg80211: fix antenna gain handling
cfg80211: fix initialization of chan->max_reg_power
ath9k: fix stale pointers potentially causing access to free'd skbs
Javier Cardona (3):
mac80211: Only process mesh config header on frames that RA_MATCH
mac80211: Don't drop frames received with mesh ttl == 1
mac80211: don't inspect Sequence Control field on control frames
Johannes Berg (5):
mac80211: use blacklist for duplicate IE check
wireless: drop invalid mesh address extension frames
mac80211: check management frame header length
mac80211: verify that skb data is present
mac80211: make sure data is accessible in EAPOL check
John W. Linville (2):
Merge branch 'for-john' of git://git.kernel.org/.../jberg/mac80211
Merge branch 'master' of git://git.kernel.org/.../linville/wireless into for-davem
Stanislaw Gruszka (1):
rt2800: validate step value for temperature compensation
Sven Eckelmann (1):
ath9k: Test for TID only in BlockAcks while checking tx status
drivers/net/wireless/ath/ath9k/xmit.c | 10 ++++-
drivers/net/wireless/rt2x00/rt2800lib.c | 2 +-
include/net/cfg80211.h | 9 ++++
net/mac80211/ibss.c | 2 +-
net/mac80211/rx.c | 74 +++++++++++++++++++++++++--------
net/mac80211/util.c | 42 +++++++++++++++----
net/wireless/core.c | 3 +-
net/wireless/reg.c | 5 ++-
net/wireless/util.c | 14 ++++---
9 files changed, 122 insertions(+), 39 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 378bd70..741918a 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -312,6 +312,7 @@ static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)
}
bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
+ bf->bf_next = NULL;
list_del(&bf->list);
spin_unlock_bh(&sc->tx.txbuflock);
@@ -393,7 +394,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0, seq_first;
u32 ba[WME_BA_BMP_SIZE >> 5];
int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
- bool rc_update = true;
+ bool rc_update = true, isba;
struct ieee80211_tx_rate rates[4];
struct ath_frame_info *fi;
int nframes;
@@ -437,13 +438,17 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
tidno = ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
tid = ATH_AN_2_TID(an, tidno);
seq_first = tid->seq_start;
+ isba = ts->ts_flags & ATH9K_TX_BA;
/*
* The hardware occasionally sends a tx status for the wrong TID.
* In this case, the BA status cannot be considered valid and all
* subframes need to be retransmitted
+ *
+ * Only BlockAcks have a TID and therefore normal Acks cannot be
+ * checked
*/
- if (tidno != ts->tid)
+ if (isba && tidno != ts->tid)
txok = false;
isaggr = bf_isaggr(bf);
@@ -1774,6 +1779,7 @@ static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
list_add_tail(&bf->list, &bf_head);
bf->bf_state.bf_type = 0;
+ bf->bf_next = NULL;
bf->bf_lastbf = bf;
ath_tx_fill_desc(sc, bf, txq, fi->framelen);
ath_tx_txqaddbuf(sc, txq, &bf_head, false);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 01dc889..59474ae 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2449,7 +2449,7 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev)
/*
* Check if temperature compensation is supported.
*/
- if (tssi_bounds[4] == 0xff)
+ if (tssi_bounds[4] == 0xff || step == 0xff)
return 0;
/*
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f8cd4cf..7d5b600 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2652,6 +2652,15 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
/**
+ * ieee80211_get_mesh_hdrlen - get mesh extension header length
+ * @meshhdr: the mesh extension header, only the flags field
+ * (first byte) will be accessed
+ * Returns the length of the extension header, which is always at
+ * least 6 bytes and at most 18 if address 5 and 6 are present.
+ */
+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
+
+/**
* DOC: Data path helpers
*
* In addition to generic utilities, cfg80211 also offers
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 5f3620f..bf87c70 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1108,7 +1108,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
sdata->u.ibss.ibss_join_req = jiffies;
- memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
+ memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
sdata->u.ibss.ssid_len = params->ssid_len;
mutex_unlock(&sdata->u.ibss.mtx);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 61c621e..00ade7f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -531,6 +531,11 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
if (ieee80211_is_action(hdr->frame_control)) {
u8 category;
+
+ /* make sure category field is present */
+ if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
+ return RX_DROP_MONITOR;
+
mgmt = (struct ieee80211_mgmt *)hdr;
category = mgmt->u.action.category;
if (category != WLAN_CATEGORY_MESH_ACTION &&
@@ -883,14 +888,16 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
*/
if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
ieee80211_is_data_present(hdr->frame_control)) {
- u16 ethertype;
- u8 *payload;
-
- payload = rx->skb->data +
- ieee80211_hdrlen(hdr->frame_control);
- ethertype = (payload[6] << 8) | payload[7];
- if (cpu_to_be16(ethertype) ==
- rx->sdata->control_port_protocol)
+ unsigned int hdrlen;
+ __be16 ethertype;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+ if (rx->skb->len < hdrlen + 8)
+ return RX_DROP_MONITOR;
+
+ skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2);
+ if (ethertype == rx->sdata->control_port_protocol)
return RX_CONTINUE;
}
@@ -1462,11 +1469,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
hdr = (struct ieee80211_hdr *)rx->skb->data;
fc = hdr->frame_control;
+
+ if (ieee80211_is_ctl(fc))
+ return RX_CONTINUE;
+
sc = le16_to_cpu(hdr->seq_ctrl);
frag = sc & IEEE80211_SCTL_FRAG;
if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
- (rx->skb)->len < 24 ||
is_multicast_ether_addr(hdr->addr1))) {
/* not fragmented */
goto out;
@@ -1889,6 +1899,20 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
hdr = (struct ieee80211_hdr *) skb->data;
hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+ /* make sure fixed part of mesh header is there, also checks skb len */
+ if (!pskb_may_pull(rx->skb, hdrlen + 6))
+ return RX_DROP_MONITOR;
+
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
+ /* make sure full mesh header is there, also checks skb len */
+ if (!pskb_may_pull(rx->skb,
+ hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
+ return RX_DROP_MONITOR;
+
+ /* reload pointers */
+ hdr = (struct ieee80211_hdr *) skb->data;
mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
/* frame is in RMC, don't forward */
@@ -1897,7 +1921,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
return RX_DROP_MONITOR;
- if (!ieee80211_is_data(hdr->frame_control))
+ if (!ieee80211_is_data(hdr->frame_control) ||
+ !(status->rx_flags & IEEE80211_RX_RA_MATCH))
return RX_CONTINUE;
if (!mesh_hdr->ttl)
@@ -1911,9 +1936,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
if (is_multicast_ether_addr(hdr->addr1)) {
mpp_addr = hdr->addr3;
proxied_addr = mesh_hdr->eaddr1;
- } else {
+ } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+ /* has_a4 already checked in ieee80211_rx_mesh_check */
mpp_addr = hdr->addr4;
proxied_addr = mesh_hdr->eaddr2;
+ } else {
+ return RX_DROP_MONITOR;
}
rcu_read_lock();
@@ -1941,12 +1969,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
}
skb_set_queue_mapping(skb, q);
- if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
- goto out;
-
if (!--mesh_hdr->ttl) {
IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
- return RX_DROP_MONITOR;
+ goto out;
}
if (!ifmsh->mshcfg.dot11MeshForwarding)
@@ -2353,6 +2378,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_SELF_PROTECTED:
+ if (len < (IEEE80211_MIN_ACTION_SIZE +
+ sizeof(mgmt->u.action.u.self_prot.action_code)))
+ break;
+
switch (mgmt->u.action.u.self_prot.action_code) {
case WLAN_SP_MESH_PEERING_OPEN:
case WLAN_SP_MESH_PEERING_CLOSE:
@@ -2371,6 +2400,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_MESH_ACTION:
+ if (len < (IEEE80211_MIN_ACTION_SIZE +
+ sizeof(mgmt->u.action.u.mesh_action.action_code)))
+ break;
+
if (!ieee80211_vif_is_mesh(&sdata->vif))
break;
if (mesh_action_is_path_sel(mgmt) &&
@@ -2913,10 +2946,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
local->dot11ReceivedFragmentCount++;
- if (ieee80211_is_mgmt(fc))
- err = skb_linearize(skb);
- else
+ if (ieee80211_is_mgmt(fc)) {
+ /* drop frame if too short for header */
+ if (skb->len < ieee80211_hdrlen(fc))
+ err = -ENOBUFS;
+ else
+ err = skb_linearize(skb);
+ } else {
err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
+ }
if (err) {
dev_kfree_skb(skb);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 94e5868..2393918 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -643,13 +643,41 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
break;
}
- if (id != WLAN_EID_VENDOR_SPECIFIC &&
- id != WLAN_EID_QUIET &&
- test_bit(id, seen_elems)) {
- elems->parse_error = true;
- left -= elen;
- pos += elen;
- continue;
+ switch (id) {
+ case WLAN_EID_SSID:
+ case WLAN_EID_SUPP_RATES:
+ case WLAN_EID_FH_PARAMS:
+ case WLAN_EID_DS_PARAMS:
+ case WLAN_EID_CF_PARAMS:
+ case WLAN_EID_TIM:
+ case WLAN_EID_IBSS_PARAMS:
+ case WLAN_EID_CHALLENGE:
+ case WLAN_EID_RSN:
+ case WLAN_EID_ERP_INFO:
+ case WLAN_EID_EXT_SUPP_RATES:
+ case WLAN_EID_HT_CAPABILITY:
+ case WLAN_EID_HT_OPERATION:
+ case WLAN_EID_VHT_CAPABILITY:
+ case WLAN_EID_VHT_OPERATION:
+ case WLAN_EID_MESH_ID:
+ case WLAN_EID_MESH_CONFIG:
+ case WLAN_EID_PEER_MGMT:
+ case WLAN_EID_PREQ:
+ case WLAN_EID_PREP:
+ case WLAN_EID_PERR:
+ case WLAN_EID_RANN:
+ case WLAN_EID_CHANNEL_SWITCH:
+ case WLAN_EID_EXT_CHANSWITCH_ANN:
+ case WLAN_EID_COUNTRY:
+ case WLAN_EID_PWR_CONSTRAINT:
+ case WLAN_EID_TIMEOUT_INTERVAL:
+ if (test_bit(id, seen_elems)) {
+ elems->parse_error = true;
+ left -= elen;
+ pos += elen;
+ continue;
+ }
+ break;
}
if (calc_crc && id < 64 && (filter & (1ULL << id)))
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 443d4d7..3f72530 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -526,8 +526,7 @@ int wiphy_register(struct wiphy *wiphy)
for (i = 0; i < sband->n_channels; i++) {
sband->channels[i].orig_flags =
sband->channels[i].flags;
- sband->channels[i].orig_mag =
- sband->channels[i].max_antenna_gain;
+ sband->channels[i].orig_mag = INT_MAX;
sband->channels[i].orig_mpwr =
sband->channels[i].max_power;
sband->channels[i].band = band;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 3b8cbbc..bcc7d7e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -908,7 +908,7 @@ static void handle_channel(struct wiphy *wiphy,
map_regdom_flags(reg_rule->flags) | bw_flags;
chan->max_antenna_gain = chan->orig_mag =
(int) MBI_TO_DBI(power_rule->max_antenna_gain);
- chan->max_power = chan->orig_mpwr =
+ chan->max_reg_power = chan->max_power = chan->orig_mpwr =
(int) MBM_TO_DBM(power_rule->max_eirp);
return;
}
@@ -1331,7 +1331,8 @@ static void handle_channel_custom(struct wiphy *wiphy,
chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
- chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+ chan->max_reg_power = chan->max_power =
+ (int) MBM_TO_DBM(power_rule->max_eirp);
}
static void handle_band_custom(struct wiphy *wiphy, enum ieee80211_band band,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ef35f4e..2762e83 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -309,23 +309,21 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
}
EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
-static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
{
int ae = meshhdr->flags & MESH_FLAGS_AE;
- /* 7.1.3.5a.2 */
+ /* 802.11-2012, 8.2.4.7.3 */
switch (ae) {
+ default:
case 0:
return 6;
case MESH_FLAGS_AE_A4:
return 12;
case MESH_FLAGS_AE_A5_A6:
return 18;
- case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
- return 24;
- default:
- return 6;
}
}
+EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
enum nl80211_iftype iftype)
@@ -373,6 +371,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
/* make sure meshdr->flags is on the linear part */
if (!pskb_may_pull(skb, hdrlen + 1))
return -1;
+ if (meshdr->flags & MESH_FLAGS_AE_A4)
+ return -1;
if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
skb_copy_bits(skb, hdrlen +
offsetof(struct ieee80211s_hdr, eaddr1),
@@ -397,6 +397,8 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
/* make sure meshdr->flags is on the linear part */
if (!pskb_may_pull(skb, hdrlen + 1))
return -1;
+ if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
+ return -1;
if (meshdr->flags & MESH_FLAGS_AE_A4)
skb_copy_bits(skb, hdrlen +
offsetof(struct ieee80211s_hdr, eaddr1),
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply related
* Re: [PATCH net-next] sk-filter: Add ability to get socket filter program
From: David Miller @ 2012-10-31 17:45 UTC (permalink / raw)
To: xemul; +Cc: netdev
In-Reply-To: <508AC533.4000809@parallels.com>
You can't only add this to asm-generic, you must add the new
option to all the arch specific headers that need it too.
^ permalink raw reply
* Re: [PATCH] vxlan: don't expire permanent entries
From: David Miller @ 2012-10-31 17:42 UTC (permalink / raw)
To: shemminger; +Cc: john.southworth, netdev
In-Reply-To: <20121026092434.4d735316@nehalam.linuxnetplumber.net>
From: Stephen Hemminger <shemminger@vyatta.com>
Date: Fri, 26 Oct 2012 09:24:34 -0700
> VXLAN confused flag versus bitmap on state.
> Based on part of a earlier patch by David Stevens.
>
> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Applied.
^ permalink raw reply
* Re: [PATCH 4/9] net: openvswitch: use this_cpu_ptr per-cpu helper
From: Christoph Lameter @ 2012-10-31 17:39 UTC (permalink / raw)
To: Shan Wei
Cc: dev-yBygre7rU0TnMu66kgdUjQ, NetDev, Kernel-Maillist, David Miller
In-Reply-To: <50910A04.5000003-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
On Wed, 31 Oct 2012, Shan Wei wrote:
> --- a/net/openvswitch/datapath.c
> +++ b/net/openvswitch/datapath.c
> @@ -208,7 +208,7 @@ void ovs_dp_process_received_packet(struct vport *p, struct sk_buff *skb)
> int error;
> int key_len;
>
> - stats = per_cpu_ptr(dp->stats_percpu, smp_processor_id());
> + stats = this_cpu_ptr(dp->stats_percpu);
Well this is an improvement and may be ok if the preemption is disabled at
this point. There is another possibility here to use this_cpu_read/add/inc
instead of determining the pointer to the local cpu first and then
performing operations on the fields. The pointer relocation with
this_cpu_xxx ops is implicit in the instructions and safe against changing
of processors. It would also save us the determination of a pointer to the
current cpus stats structure.
^ permalink raw reply
* Re: [PATCH -next] qla3xxx: remove unused variable in ql_process_mac_tx_intr()
From: David Miller @ 2012-10-31 17:36 UTC (permalink / raw)
To: weiyj.lk; +Cc: jitendra.kalsaria, ron.mercer, yongjun_wei, linux-driver, netdev
In-Reply-To: <CAPgLHd-rHiLuMR45R7uDWx=BVNr01XpcG6XG0_uMwjbhUGyKEw@mail.gmail.com>
From: Wei Yongjun <weiyj.lk@gmail.com>
Date: Fri, 26 Oct 2012 23:30:31 +0800
> From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>
> The variable retval is initialized but never used
> otherwise, so remove the unused variable.
>
> dpatch engine is used to auto generate this patch.
> (https://github.com/weiyj/dpatch)
>
> Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Applied.
^ permalink raw reply
* Re: [PATCH -next] qla3xxx: use module_pci_driver to simplify the code
From: David Miller @ 2012-10-31 17:36 UTC (permalink / raw)
To: weiyj.lk; +Cc: jitendra.kalsaria, ron.mercer, yongjun_wei, linux-driver, netdev
In-Reply-To: <CAPgLHd_Xu7TKZ_mqQ2r7A2GVCo+Us6kEggHc5d+hhg4Hh6cukA@mail.gmail.com>
From: Wei Yongjun <weiyj.lk@gmail.com>
Date: Fri, 26 Oct 2012 23:02:30 +0800
> From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>
> Use the module_pci_driver() macro to make the code simpler
> by eliminating module_init and module_exit calls.
>
> dpatch engine is used to auto generate this patch.
> (https://github.com/weiyj/dpatch)
>
> Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Applied.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox