* Re: [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Joe Perches @ 2013-09-12 0:41 UTC (permalink / raw)
To: Al Viro
Cc: Tetsuo Handa, linux-kernel, kosaki.motohiro, keescook, fweisbec,
dan.carpenter, devel, gregkh, tushar.behera, lidza.louina, davem,
kuznet, jmorris, yoshfuji, kaber, courmisch, vyasevich, nhorman,
netdev, linux-sctp
In-Reply-To: <20130912001911.GO13318@ZenIV.linux.org.uk>
On Thu, 2013-09-12 at 01:19 +0100, Al Viro wrote:
> On Wed, Sep 11, 2013 at 05:04:17PM -0700, Joe Perches wrote:
> > On Thu, 2013-09-12 at 08:40 +0900, Tetsuo Handa wrote:
> > > Joe Perches wrote:
> > > > - seq_printf(m, "%s%d%n", con->name, con->index, &len);
> > > > + len = seq_printf(m, "%s%d", con->name, con->index);
> > >
> > > Isn't len always 0 or -1 ?
> >
> > Right. Well you're no fun...
> >
> > These uses would seem broken anyway because the
> > seq_printf isn't itself tested for correctness.
> >
> > Hmm.
> >
> > Also, there's a large amount of code that appears
> > to do calculations with pos or len like:
> >
> > pos += seq_printf(handle, fmt. ...)
>
> ... and most of that code proceeds to ignore pos completely.
> Note that ->show() is *NOT* supposed to return the number of
> characters it has/would like to have produced. Just return
> 0 and be done with that; overflows are dealt with just fine.
> The large amount, BTW, is below 100 lines, AFAICS, in rather
> few files.
Unfortunately, when you count the uses of
return seq_printf(...)
it's rather higher and all the callers need
to be chased down too.
$ grep -rP --include=*.[ch] "^[ \t]*(\S[ \t\S]*=|return[\s\(]*)\s*\bseq_[v]?printf\b" * | wc -l
320
$ grep -rPl --include=*.[ch] "^[ \t]*(\S[ \t\S]*=|return[\s\(]*)\s*\bseq_[v]?printf\b" *|wc -l
81
> Just bury the cargo-culting crap. All those += seq_printf() should
> be simply calling it.
Most likely.
> The *only* reason to look at the return
> value is "if we'd already overflown the buffer, I'd rather skipped
> the costly generation of the rest of the record". In that case
> seq_printf() returning -1 means "skip it, nothing else will fit and
> caller will be repeating with bigger buffer anyway".
Perhaps changing the seq_vprintf return from 0 to len
and testing for -1 would work.
Still would need to change a few lines in netfilter
and probably a few other places.
^ permalink raw reply
* Re: [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Al Viro @ 2013-09-12 0:19 UTC (permalink / raw)
To: Joe Perches
Cc: Tetsuo Handa, linux-kernel, kosaki.motohiro, keescook, fweisbec,
dan.carpenter, devel, gregkh, tushar.behera, lidza.louina, davem,
kuznet, jmorris, yoshfuji, kaber, courmisch, vyasevich, nhorman,
netdev, linux-sctp
In-Reply-To: <1378944257.4714.45.camel@joe-AO722>
On Wed, Sep 11, 2013 at 05:04:17PM -0700, Joe Perches wrote:
> On Thu, 2013-09-12 at 08:40 +0900, Tetsuo Handa wrote:
> > Joe Perches wrote:
> > > - seq_printf(m, "%s%d%n", con->name, con->index, &len);
> > > + len = seq_printf(m, "%s%d", con->name, con->index);
> >
> > Isn't len always 0 or -1 ?
>
> Right. Well you're no fun...
>
> These uses would seem broken anyway because the
> seq_printf isn't itself tested for correctness.
>
> Hmm.
>
> Also, there's a large amount of code that appears
> to do calculations with pos or len like:
>
> pos += seq_printf(handle, fmt. ...)
... and most of that code proceeds to ignore pos completely.
Note that ->show() is *NOT* supposed to return the number of
characters it has/would like to have produced. Just return
0 and be done with that; overflows are dealt with just fine.
The large amount, BTW, is below 100 lines, AFAICS, in rather
few files.
> There are very few that seem to use it correctly
> like netfilter.
> Suggestions?
Just bury the cargo-culting crap. All those += seq_printf() should
be simply calling it. The *only* reason to look at the return
value is "if we'd already overflown the buffer, I'd rather skipped
the costly generation of the rest of the record". In that case
seq_printf() returning -1 means "skip it, nothing else will fit and
caller will be repeating with bigger buffer anyway".
^ permalink raw reply
* Re: [PATCH 20/52] net: fealnx: remove unnecessary pci_set_drvdata()
From: Jingoo Han @ 2013-09-12 0:11 UTC (permalink / raw)
To: 'Sergei Shtylyov'
Cc: 'David S. Miller', netdev, 'Jingoo Han'
In-Reply-To: <5230B435.2050908@cogentembedded.com>
On Thursday, September 12, 2013 3:20 AM, Jingoo Han wrote:
> On 09/11/2013 11:40 AM, Jingoo Han wrote:
>
> > The driver core clears the driver data to NULL after device_release
> > or on probe failure. Thus, it is not needed to manually clear the
> > device driver data to NULL.
>
> > Signed-off-by: Jingoo Han <jg1.han@samsung.com>
> > ---
> > drivers/net/ethernet/fealnx.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
>
> > diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
> > index c706b7a..99194d1 100644
> > --- a/drivers/net/ethernet/fealnx.c
> > +++ b/drivers/net/ethernet/fealnx.c
> > @@ -699,9 +699,9 @@ static void fealnx_remove_one(struct pci_dev *pdev)
> > pci_iounmap(pdev, np->mem);
> > free_netdev(dev);
> > pci_release_regions(pdev);
> > - pci_set_drvdata(pdev, NULL);
> > - } else
> > + } else {
> > printk(KERN_ERR "fealnx: remove for unknown device\n");
> > + }
>
> No "drove-by" coding style fixes, please.
Hi Sergei,
Sorry, but I just want to know the reason. :-)
Would you let know the reason not to add coding style fixes?
Thank you.
Best regards,
Jingoo Han
^ permalink raw reply
* Re: [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Joe Perches @ 2013-09-12 0:04 UTC (permalink / raw)
To: Tetsuo Handa
Cc: linux-kernel, kosaki.motohiro, keescook, fweisbec, dan.carpenter,
devel, gregkh, tushar.behera, lidza.louina, davem, kuznet,
jmorris, yoshfuji, kaber, courmisch, vyasevich, nhorman, netdev,
linux-sctp
In-Reply-To: <201309120840.HHE37542.OJMFFHSOQOtVFL@I-love.SAKURA.ne.jp>
On Thu, 2013-09-12 at 08:40 +0900, Tetsuo Handa wrote:
> Joe Perches wrote:
> > - seq_printf(m, "%s%d%n", con->name, con->index, &len);
> > + len = seq_printf(m, "%s%d", con->name, con->index);
>
> Isn't len always 0 or -1 ?
Right. Well you're no fun...
These uses would seem broken anyway because the
seq_printf isn't itself tested for correctness.
Hmm.
Also, there's a large amount of code that appears
to do calculations with pos or len like:
pos += seq_printf(handle, fmt. ...)
There are very few that seem to use it correctly
like netfilter.
$ grep -rP --include=*.[ch] "^[ \t]*\S[ \t\S]*\bseq_[v]?printf\b" *
Suggestions?
> int seq_vprintf(struct seq_file *m, const char *f, va_list args)
> {
> int len;
>
> if (m->count < m->size) {
> len = vsnprintf(m->buf + m->count, m->size - m->count, f, args);
> if (m->count + len < m->size) {
> m->count += len;
> return 0;
> }
> }
> seq_set_overflow(m);
> return -1;
> }
> EXPORT_SYMBOL(seq_vprintf);
>
> int seq_printf(struct seq_file *m, const char *f, ...)
> {
> int ret;
> va_list args;
>
> va_start(args, f);
> ret = seq_vprintf(m, f, args);
> va_end(args);
>
> return ret;
> }
> EXPORT_SYMBOL(seq_printf);
^ permalink raw reply
* Re: [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Joe Perches @ 2013-09-11 23:43 UTC (permalink / raw)
To: Kees Cook
Cc: LKML, KOSAKI Motohiro, Frederic Weisbecker, Dan Carpenter, devel,
Greg Kroah-Hartman, Tushar Behera, Lidza Louina, David S. Miller,
Alexey Kuznetsov, James Morris, Hideaki YOSHIFUJI,
Patrick McHardy, Remi Denis-Courmont, Vlad Yasevich, Neil Horman,
netdev, linux-sctp
In-Reply-To: <CAGXu5jLyCGuSRqEGCSw=VrrOvOr=aAok6ZZTAj_qmDA3CbmLww@mail.gmail.com>
On Wed, 2013-09-11 at 16:29 -0700, Kees Cook wrote:
> On Wed, Sep 11, 2013 at 4:22 PM, Joe Perches <joe@perches.com> wrote:
> > Using vsnprintf or its derivatives with %n can have security
> > vulnerability implications.
> >
> > Prior to commit fef20d9c1380
> > ("vsprintf: unify the format decoding layer for its 3 users"),
> > any use of %n was ignored.
> >
> > Reintroduce this feature and convert the existing uses of %n
> > to use the return length from vsnprintf or its derivatives.
> >
> > Signed-off-by: Joe Perches <joe@perches.com>
> > Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> (proc bits)
> > cc: Kees Cook <keescook@chromium.org>
> > cc: Frederic Weisbecker <fweisbec@gmail.com>
>
> Yes, please. It might also be worth updating
> Documentation/printk-formats.txt to mention that %n has intentionally
> removed and will be ignored.
Fine with me if you want to update that file.
It doesn't currently try to be a complete man page
for vsnprintf though.
vsprintf.c does have kernel-doc documentation and
that already does show that %n is ignored.
^ permalink raw reply
* Re: [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Tetsuo Handa @ 2013-09-11 23:40 UTC (permalink / raw)
To: joe, linux-kernel
Cc: kosaki.motohiro, keescook, fweisbec, dan.carpenter, devel, gregkh,
tushar.behera, lidza.louina, davem, kuznet, jmorris, yoshfuji,
kaber, courmisch, vyasevich, nhorman, netdev, linux-sctp
In-Reply-To: <1378941761.4714.37.camel@joe-AO722>
Joe Perches wrote:
> - seq_printf(m, "%s%d%n", con->name, con->index, &len);
> + len = seq_printf(m, "%s%d", con->name, con->index);
Isn't len always 0 or -1 ?
int seq_vprintf(struct seq_file *m, const char *f, va_list args)
{
int len;
if (m->count < m->size) {
len = vsnprintf(m->buf + m->count, m->size - m->count, f, args);
if (m->count + len < m->size) {
m->count += len;
return 0;
}
}
seq_set_overflow(m);
return -1;
}
EXPORT_SYMBOL(seq_vprintf);
int seq_printf(struct seq_file *m, const char *f, ...)
{
int ret;
va_list args;
va_start(args, f);
ret = seq_vprintf(m, f, args);
va_end(args);
return ret;
}
EXPORT_SYMBOL(seq_printf);
^ permalink raw reply
* Re: [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Kees Cook @ 2013-09-11 23:29 UTC (permalink / raw)
To: Joe Perches
Cc: devel, Lidza Louina, Neil Horman, Patrick McHardy,
Hideaki YOSHIFUJI, Frederic Weisbecker, Vlad Yasevich, LKML,
James Morris, Remi Denis-Courmont, linux-sctp, netdev,
KOSAKI Motohiro, Greg Kroah-Hartman, Alexey Kuznetsov,
David S. Miller, Dan Carpenter, Tushar Behera
In-Reply-To: <1378941761.4714.37.camel@joe-AO722>
On Wed, Sep 11, 2013 at 4:22 PM, Joe Perches <joe@perches.com> wrote:
> Using vsnprintf or its derivatives with %n can have security
> vulnerability implications.
>
> Prior to commit fef20d9c1380
> ("vsprintf: unify the format decoding layer for its 3 users"),
> any use of %n was ignored.
>
> Reintroduce this feature and convert the existing uses of %n
> to use the return length from vsnprintf or its derivatives.
>
> Signed-off-by: Joe Perches <joe@perches.com>
> Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> (proc bits)
> cc: Kees Cook <keescook@chromium.org>
> cc: Frederic Weisbecker <fweisbec@gmail.com>
Yes, please. It might also be worth updating
Documentation/printk-formats.txt to mention that %n has intentionally
removed and will be ignored.
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
>
> ---
>
> Not particularly well tested...
>
> fs/proc/consoles.c | 2 +-
> fs/proc/nommu.c | 20 ++++++-------
> fs/proc/task_mmu.c | 18 +++++------
> fs/proc/task_nommu.c | 20 ++++++-------
> lib/vsprintf.c | 21 ++++++-------
> net/ipv4/fib_trie.c | 30 ++++++++-----------
> net/ipv4/ping.c | 19 ++++++------
> net/ipv4/tcp_ipv4.c | 84 +++++++++++++++++++++++++---------------------------
> net/ipv4/udp.c | 19 ++++++------
> net/phonet/socket.c | 32 ++++++++++----------
> net/sctp/objcnt.c | 5 ++--
> 11 files changed, 132 insertions(+), 138 deletions(-)
>
> diff --git a/fs/proc/consoles.c b/fs/proc/consoles.c
> index b701eaa..42f2bb7 100644
> --- a/fs/proc/consoles.c
> +++ b/fs/proc/consoles.c
> @@ -47,7 +47,7 @@ static int show_console_dev(struct seq_file *m, void *v)
> con_flags[a].name : ' ';
> flags[a] = 0;
>
> - seq_printf(m, "%s%d%n", con->name, con->index, &len);
> + len = seq_printf(m, "%s%d", con->name, con->index);
> len = 21 - len;
> if (len < 1)
> len = 1;
> diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
> index ccfd99b..91cfd19 100644
> --- a/fs/proc/nommu.c
> +++ b/fs/proc/nommu.c
> @@ -50,16 +50,16 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
> ino = inode->i_ino;
> }
>
> - seq_printf(m,
> - "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
> - region->vm_start,
> - region->vm_end,
> - flags & VM_READ ? 'r' : '-',
> - flags & VM_WRITE ? 'w' : '-',
> - flags & VM_EXEC ? 'x' : '-',
> - flags & VM_MAYSHARE ? flags & VM_SHARED ? 'S' : 's' : 'p',
> - ((loff_t)region->vm_pgoff) << PAGE_SHIFT,
> - MAJOR(dev), MINOR(dev), ino, &len);
> + len = seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
> + region->vm_start,
> + region->vm_end,
> + flags & VM_READ ? 'r' : '-',
> + flags & VM_WRITE ? 'w' : '-',
> + flags & VM_EXEC ? 'x' : '-',
> + flags & VM_MAYSHARE ?
> + flags & VM_SHARED ? 'S' : 's' : 'p',
> + ((loff_t)region->vm_pgoff) << PAGE_SHIFT,
> + MAJOR(dev), MINOR(dev), ino);
>
> if (file) {
> len = 25 + sizeof(void *) * 6 - len;
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 107d026..f84ee9f 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -286,15 +286,15 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
> if (stack_guard_page_end(vma, end))
> end -= PAGE_SIZE;
>
> - seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
> - start,
> - end,
> - flags & VM_READ ? 'r' : '-',
> - flags & VM_WRITE ? 'w' : '-',
> - flags & VM_EXEC ? 'x' : '-',
> - flags & VM_MAYSHARE ? 's' : 'p',
> - pgoff,
> - MAJOR(dev), MINOR(dev), ino, &len);
> + len = seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
> + start,
> + end,
> + flags & VM_READ ? 'r' : '-',
> + flags & VM_WRITE ? 'w' : '-',
> + flags & VM_EXEC ? 'x' : '-',
> + flags & VM_MAYSHARE ? 's' : 'p',
> + pgoff,
> + MAJOR(dev), MINOR(dev), ino);
>
> /*
> * Print the dentry name for named mappings, and a
> diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
> index 56123a6..1d7bbe5 100644
> --- a/fs/proc/task_nommu.c
> +++ b/fs/proc/task_nommu.c
> @@ -155,16 +155,16 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
> pgoff = (loff_t)vma->vm_pgoff << PAGE_SHIFT;
> }
>
> - seq_printf(m,
> - "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
> - vma->vm_start,
> - vma->vm_end,
> - flags & VM_READ ? 'r' : '-',
> - flags & VM_WRITE ? 'w' : '-',
> - flags & VM_EXEC ? 'x' : '-',
> - flags & VM_MAYSHARE ? flags & VM_SHARED ? 'S' : 's' : 'p',
> - pgoff,
> - MAJOR(dev), MINOR(dev), ino, &len);
> + len = seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
> + vma->vm_start,
> + vma->vm_end,
> + flags & VM_READ ? 'r' : '-',
> + flags & VM_WRITE ? 'w' : '-',
> + flags & VM_EXEC ? 'x' : '-',
> + flags & VM_MAYSHARE ?
> + flags & VM_SHARED ? 'S' : 's' : 'p',
> + pgoff,
> + MAJOR(dev), MINOR(dev), ino);
>
> if (file) {
> pad_len_spaces(m, len);
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 26559bd..43c2ea0 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -1683,18 +1683,19 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
> break;
>
> case FORMAT_TYPE_NRCHARS: {
> + /* skip %n 's argument */
> u8 qualifier = spec.qualifier;
> + void *skip_arg;
>
> - if (qualifier == 'l') {
> - long *ip = va_arg(args, long *);
> - *ip = (str - buf);
> - } else if (_tolower(qualifier) == 'z') {
> - size_t *ip = va_arg(args, size_t *);
> - *ip = (str - buf);
> - } else {
> - int *ip = va_arg(args, int *);
> - *ip = (str - buf);
> - }
> + WARN_ONCE(1, "Please remove ignored use of %%n in '%s'\n",
> + old_fmt);
> +
> + if (qualifier == 'l')
> + skip_arg = va_arg(args, long *);
> + else if (_tolower(qualifier) == 'z')
> + skip_arg = va_arg(args, size_t *);
> + else
> + skip_arg = va_arg(args, int *);
> break;
> }
>
> diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
> index 3df6d3e..ddf1e9c 100644
> --- a/net/ipv4/fib_trie.c
> +++ b/net/ipv4/fib_trie.c
> @@ -2537,24 +2537,20 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
> continue;
>
> if (fi)
> - seq_printf(seq,
> - "%s\t%08X\t%08X\t%04X\t%d\t%u\t"
> - "%d\t%08X\t%d\t%u\t%u%n",
> - fi->fib_dev ? fi->fib_dev->name : "*",
> - prefix,
> - fi->fib_nh->nh_gw, flags, 0, 0,
> - fi->fib_priority,
> - mask,
> - (fi->fib_advmss ?
> - fi->fib_advmss + 40 : 0),
> - fi->fib_window,
> - fi->fib_rtt >> 3, &len);
> + len = seq_printf(seq, "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
> + (fi->fib_dev ?
> + fi->fib_dev->name : "*"),
> + prefix,
> + fi->fib_nh->nh_gw, flags,
> + 0, 0, fi->fib_priority, mask,
> + (fi->fib_advmss ?
> + fi->fib_advmss + 40 : 0),
> + fi->fib_window,
> + fi->fib_rtt >> 3);
> else
> - seq_printf(seq,
> - "*\t%08X\t%08X\t%04X\t%d\t%u\t"
> - "%d\t%08X\t%d\t%u\t%u%n",
> - prefix, 0, flags, 0, 0, 0,
> - mask, 0, 0, 0, &len);
> + len = seq_printf(seq, "*\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
> + prefix, 0, flags, 0, 0, 0,
> + mask, 0, 0, 0);
>
> seq_printf(seq, "%*s\n", 127 - len, "");
> }
> diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
> index d7d9882..ac8d79f 100644
> --- a/net/ipv4/ping.c
> +++ b/net/ipv4/ping.c
> @@ -1081,16 +1081,15 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
> __u16 destp = ntohs(inet->inet_dport);
> __u16 srcp = ntohs(inet->inet_sport);
>
> - seq_printf(f, "%5d: %08X:%04X %08X:%04X"
> - " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d%n",
> - bucket, src, srcp, dest, destp, sp->sk_state,
> - sk_wmem_alloc_get(sp),
> - sk_rmem_alloc_get(sp),
> - 0, 0L, 0,
> - from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
> - 0, sock_i_ino(sp),
> - atomic_read(&sp->sk_refcnt), sp,
> - atomic_read(&sp->sk_drops), len);
> + *len = seq_printf(f, "%5d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d",
> + bucket, src, srcp, dest, destp, sp->sk_state,
> + sk_wmem_alloc_get(sp),
> + sk_rmem_alloc_get(sp),
> + 0, 0L, 0,
> + from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
> + 0, sock_i_ino(sp),
> + atomic_read(&sp->sk_refcnt), sp,
> + atomic_read(&sp->sk_drops));
> }
>
> static int ping_v4_seq_show(struct seq_file *seq, void *v)
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index b14266b..1279c16 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -2603,24 +2603,24 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
> const struct inet_request_sock *ireq = inet_rsk(req);
> long delta = req->expires - jiffies;
>
> - seq_printf(f, "%4d: %08X:%04X %08X:%04X"
> - " %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK%n",
> - i,
> - ireq->loc_addr,
> - ntohs(inet_sk(sk)->inet_sport),
> - ireq->rmt_addr,
> - ntohs(ireq->rmt_port),
> - TCP_SYN_RECV,
> - 0, 0, /* could print option size, but that is af dependent. */
> - 1, /* timers active (only the expire timer) */
> - jiffies_delta_to_clock_t(delta),
> - req->num_timeout,
> - from_kuid_munged(seq_user_ns(f), uid),
> - 0, /* non standard timer */
> - 0, /* open_requests have no inode */
> - atomic_read(&sk->sk_refcnt),
> - req,
> - len);
> + *len = seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK",
> + i,
> + ireq->loc_addr,
> + ntohs(inet_sk(sk)->inet_sport),
> + ireq->rmt_addr,
> + ntohs(ireq->rmt_port),
> + TCP_SYN_RECV,
> + 0, 0, /* could print option size,
> + * but that is af dependent.
> + */
> + 1, /* timers active (only the expire timer) */
> + jiffies_delta_to_clock_t(delta),
> + req->num_timeout,
> + from_kuid_munged(seq_user_ns(f), uid),
> + 0, /* non standard timer */
> + 0, /* open_requests have no inode */
> + atomic_read(&sk->sk_refcnt),
> + req);
> }
>
> static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
> @@ -2661,26 +2661,25 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
> */
> rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
>
> - seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
> - "%08X %5u %8d %lu %d %pK %lu %lu %u %u %d%n",
> - i, src, srcp, dest, destp, sk->sk_state,
> - tp->write_seq - tp->snd_una,
> - rx_queue,
> - timer_active,
> - jiffies_delta_to_clock_t(timer_expires - jiffies),
> - icsk->icsk_retransmits,
> - from_kuid_munged(seq_user_ns(f), sock_i_uid(sk)),
> - icsk->icsk_probes_out,
> - sock_i_ino(sk),
> - atomic_read(&sk->sk_refcnt), sk,
> - jiffies_to_clock_t(icsk->icsk_rto),
> - jiffies_to_clock_t(icsk->icsk_ack.ato),
> - (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
> - tp->snd_cwnd,
> - sk->sk_state == TCP_LISTEN ?
> - (fastopenq ? fastopenq->max_qlen : 0) :
> - (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh),
> - len);
> + *len = seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d",
> + i, src, srcp, dest, destp, sk->sk_state,
> + tp->write_seq - tp->snd_una,
> + rx_queue,
> + timer_active,
> + jiffies_delta_to_clock_t(timer_expires - jiffies),
> + icsk->icsk_retransmits,
> + from_kuid_munged(seq_user_ns(f), sock_i_uid(sk)),
> + icsk->icsk_probes_out,
> + sock_i_ino(sk),
> + atomic_read(&sk->sk_refcnt), sk,
> + jiffies_to_clock_t(icsk->icsk_rto),
> + jiffies_to_clock_t(icsk->icsk_ack.ato),
> + (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
> + tp->snd_cwnd,
> + sk->sk_state == TCP_LISTEN ?
> + (fastopenq ? fastopenq->max_qlen : 0) :
> + (tcp_in_initial_slowstart(tp) ? -1 :
> + tp->snd_ssthresh));
> }
>
> static void get_timewait4_sock(const struct inet_timewait_sock *tw,
> @@ -2695,11 +2694,10 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
> destp = ntohs(tw->tw_dport);
> srcp = ntohs(tw->tw_sport);
>
> - seq_printf(f, "%4d: %08X:%04X %08X:%04X"
> - " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
> - i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
> - 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
> - atomic_read(&tw->tw_refcnt), tw, len);
> + *len = seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK",
> + i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
> + 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
> + atomic_read(&tw->tw_refcnt), tw);
> }
>
> #define TMPSZ 150
> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> index 74d2c95..ddc24a2d 100644
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -2158,16 +2158,15 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
> __u16 destp = ntohs(inet->inet_dport);
> __u16 srcp = ntohs(inet->inet_sport);
>
> - seq_printf(f, "%5d: %08X:%04X %08X:%04X"
> - " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d%n",
> - bucket, src, srcp, dest, destp, sp->sk_state,
> - sk_wmem_alloc_get(sp),
> - sk_rmem_alloc_get(sp),
> - 0, 0L, 0,
> - from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
> - 0, sock_i_ino(sp),
> - atomic_read(&sp->sk_refcnt), sp,
> - atomic_read(&sp->sk_drops), len);
> + *len = seq_printf(f, "%5d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d",
> + bucket, src, srcp, dest, destp, sp->sk_state,
> + sk_wmem_alloc_get(sp),
> + sk_rmem_alloc_get(sp),
> + 0, 0L, 0,
> + from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
> + 0, sock_i_ino(sp),
> + atomic_read(&sp->sk_refcnt), sp,
> + atomic_read(&sp->sk_drops));
> }
>
> int udp4_seq_show(struct seq_file *seq, void *v)
> diff --git a/net/phonet/socket.c b/net/phonet/socket.c
> index 77e38f7..553f896 100644
> --- a/net/phonet/socket.c
> +++ b/net/phonet/socket.c
> @@ -598,21 +598,20 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
> int len;
>
> if (v == SEQ_START_TOKEN)
> - seq_printf(seq, "%s%n", "pt loc rem rs st tx_queue rx_queue "
> - " uid inode ref pointer drops", &len);
> + len = seq_puts(seq, "pt loc rem rs st tx_queue rx_queue uid inode ref pointer drops");
> else {
> struct sock *sk = v;
> struct pn_sock *pn = pn_sk(sk);
>
> - seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu "
> - "%d %pK %d%n",
> - sk->sk_protocol, pn->sobject, pn->dobject,
> - pn->resource, sk->sk_state,
> - sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
> - from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
> - sock_i_ino(sk),
> - atomic_read(&sk->sk_refcnt), sk,
> - atomic_read(&sk->sk_drops), &len);
> + len = seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu %d %pK %d",
> + sk->sk_protocol, pn->sobject, pn->dobject,
> + pn->resource, sk->sk_state,
> + sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
> + from_kuid_munged(seq_user_ns(seq),
> + sock_i_uid(sk)),
> + sock_i_ino(sk),
> + atomic_read(&sk->sk_refcnt), sk,
> + atomic_read(&sk->sk_drops));
> }
> seq_printf(seq, "%*s\n", 127 - len, "");
> return 0;
> @@ -788,15 +787,16 @@ static int pn_res_seq_show(struct seq_file *seq, void *v)
> int len;
>
> if (v == SEQ_START_TOKEN)
> - seq_printf(seq, "%s%n", "rs uid inode", &len);
> + len = seq_puts(seq, "rs uid inode");
> else {
> struct sock **psk = v;
> struct sock *sk = *psk;
>
> - seq_printf(seq, "%02X %5u %lu%n",
> - (int) (psk - pnres.sk),
> - from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
> - sock_i_ino(sk), &len);
> + len = seq_printf(seq, "%02X %5u %lu",
> + (int) (psk - pnres.sk),
> + from_kuid_munged(seq_user_ns(seq),
> + sock_i_uid(sk)),
> + sock_i_ino(sk));
> }
> seq_printf(seq, "%*s\n", 63 - len, "");
> return 0;
> diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
> index 5ea573b..8034325 100644
> --- a/net/sctp/objcnt.c
> +++ b/net/sctp/objcnt.c
> @@ -82,8 +82,9 @@ static int sctp_objcnt_seq_show(struct seq_file *seq, void *v)
> int i, len;
>
> i = (int)*(loff_t *)v;
> - seq_printf(seq, "%s: %d%n", sctp_dbg_objcnt[i].label,
> - atomic_read(sctp_dbg_objcnt[i].counter), &len);
> + len = seq_printf(seq, "%s: %d",
> + sctp_dbg_objcnt[i].label,
> + atomic_read(sctp_dbg_objcnt[i].counter));
> seq_printf(seq, "%*s\n", 127 - len, "");
> return 0;
> }
> --
> 1.8.1.2.459.gbcd45b4.dirty
>
>
>
--
Kees Cook
Chrome OS Security
^ permalink raw reply
* [RFC PATCH] vsnprintf: Remove use of %n and convert existing uses
From: Joe Perches @ 2013-09-11 23:22 UTC (permalink / raw)
To: LKML
Cc: KOSAKI Motohiro, Kees Cook, Frederic Weisbecker, Dan Carpenter,
devel, Greg Kroah-Hartman, Tushar Behera, Lidza Louina,
David S. Miller, Alexey Kuznetsov, James Morris,
Hideaki YOSHIFUJI, Patrick McHardy, Remi Denis-Courmont,
Vlad Yasevich, Neil Horman, netdev, linux-sctp
In-Reply-To: <CAGXu5jLTjrPr=GwOmMcu55Qp9K-_XS75xq9NJ0vBUEwy-i_YMw@mail.gmail.com>
Using vsnprintf or its derivatives with %n can have security
vulnerability implications.
Prior to commit fef20d9c1380
("vsprintf: unify the format decoding layer for its 3 users"),
any use of %n was ignored.
Reintroduce this feature and convert the existing uses of %n
to use the return length from vsnprintf or its derivatives.
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> (proc bits)
cc: Kees Cook <keescook@chromium.org>
cc: Frederic Weisbecker <fweisbec@gmail.com>
---
Not particularly well tested...
fs/proc/consoles.c | 2 +-
fs/proc/nommu.c | 20 ++++++-------
fs/proc/task_mmu.c | 18 +++++------
fs/proc/task_nommu.c | 20 ++++++-------
lib/vsprintf.c | 21 ++++++-------
net/ipv4/fib_trie.c | 30 ++++++++-----------
net/ipv4/ping.c | 19 ++++++------
net/ipv4/tcp_ipv4.c | 84 +++++++++++++++++++++++++---------------------------
net/ipv4/udp.c | 19 ++++++------
net/phonet/socket.c | 32 ++++++++++----------
net/sctp/objcnt.c | 5 ++--
11 files changed, 132 insertions(+), 138 deletions(-)
diff --git a/fs/proc/consoles.c b/fs/proc/consoles.c
index b701eaa..42f2bb7 100644
--- a/fs/proc/consoles.c
+++ b/fs/proc/consoles.c
@@ -47,7 +47,7 @@ static int show_console_dev(struct seq_file *m, void *v)
con_flags[a].name : ' ';
flags[a] = 0;
- seq_printf(m, "%s%d%n", con->name, con->index, &len);
+ len = seq_printf(m, "%s%d", con->name, con->index);
len = 21 - len;
if (len < 1)
len = 1;
diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
index ccfd99b..91cfd19 100644
--- a/fs/proc/nommu.c
+++ b/fs/proc/nommu.c
@@ -50,16 +50,16 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
ino = inode->i_ino;
}
- seq_printf(m,
- "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
- region->vm_start,
- region->vm_end,
- flags & VM_READ ? 'r' : '-',
- flags & VM_WRITE ? 'w' : '-',
- flags & VM_EXEC ? 'x' : '-',
- flags & VM_MAYSHARE ? flags & VM_SHARED ? 'S' : 's' : 'p',
- ((loff_t)region->vm_pgoff) << PAGE_SHIFT,
- MAJOR(dev), MINOR(dev), ino, &len);
+ len = seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
+ region->vm_start,
+ region->vm_end,
+ flags & VM_READ ? 'r' : '-',
+ flags & VM_WRITE ? 'w' : '-',
+ flags & VM_EXEC ? 'x' : '-',
+ flags & VM_MAYSHARE ?
+ flags & VM_SHARED ? 'S' : 's' : 'p',
+ ((loff_t)region->vm_pgoff) << PAGE_SHIFT,
+ MAJOR(dev), MINOR(dev), ino);
if (file) {
len = 25 + sizeof(void *) * 6 - len;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 107d026..f84ee9f 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -286,15 +286,15 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
if (stack_guard_page_end(vma, end))
end -= PAGE_SIZE;
- seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
- start,
- end,
- flags & VM_READ ? 'r' : '-',
- flags & VM_WRITE ? 'w' : '-',
- flags & VM_EXEC ? 'x' : '-',
- flags & VM_MAYSHARE ? 's' : 'p',
- pgoff,
- MAJOR(dev), MINOR(dev), ino, &len);
+ len = seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
+ start,
+ end,
+ flags & VM_READ ? 'r' : '-',
+ flags & VM_WRITE ? 'w' : '-',
+ flags & VM_EXEC ? 'x' : '-',
+ flags & VM_MAYSHARE ? 's' : 'p',
+ pgoff,
+ MAJOR(dev), MINOR(dev), ino);
/*
* Print the dentry name for named mappings, and a
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 56123a6..1d7bbe5 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -155,16 +155,16 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
pgoff = (loff_t)vma->vm_pgoff << PAGE_SHIFT;
}
- seq_printf(m,
- "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
- vma->vm_start,
- vma->vm_end,
- flags & VM_READ ? 'r' : '-',
- flags & VM_WRITE ? 'w' : '-',
- flags & VM_EXEC ? 'x' : '-',
- flags & VM_MAYSHARE ? flags & VM_SHARED ? 'S' : 's' : 'p',
- pgoff,
- MAJOR(dev), MINOR(dev), ino, &len);
+ len = seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
+ vma->vm_start,
+ vma->vm_end,
+ flags & VM_READ ? 'r' : '-',
+ flags & VM_WRITE ? 'w' : '-',
+ flags & VM_EXEC ? 'x' : '-',
+ flags & VM_MAYSHARE ?
+ flags & VM_SHARED ? 'S' : 's' : 'p',
+ pgoff,
+ MAJOR(dev), MINOR(dev), ino);
if (file) {
pad_len_spaces(m, len);
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 26559bd..43c2ea0 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1683,18 +1683,19 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
break;
case FORMAT_TYPE_NRCHARS: {
+ /* skip %n 's argument */
u8 qualifier = spec.qualifier;
+ void *skip_arg;
- if (qualifier == 'l') {
- long *ip = va_arg(args, long *);
- *ip = (str - buf);
- } else if (_tolower(qualifier) == 'z') {
- size_t *ip = va_arg(args, size_t *);
- *ip = (str - buf);
- } else {
- int *ip = va_arg(args, int *);
- *ip = (str - buf);
- }
+ WARN_ONCE(1, "Please remove ignored use of %%n in '%s'\n",
+ old_fmt);
+
+ if (qualifier == 'l')
+ skip_arg = va_arg(args, long *);
+ else if (_tolower(qualifier) == 'z')
+ skip_arg = va_arg(args, size_t *);
+ else
+ skip_arg = va_arg(args, int *);
break;
}
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 3df6d3e..ddf1e9c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2537,24 +2537,20 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
continue;
if (fi)
- seq_printf(seq,
- "%s\t%08X\t%08X\t%04X\t%d\t%u\t"
- "%d\t%08X\t%d\t%u\t%u%n",
- fi->fib_dev ? fi->fib_dev->name : "*",
- prefix,
- fi->fib_nh->nh_gw, flags, 0, 0,
- fi->fib_priority,
- mask,
- (fi->fib_advmss ?
- fi->fib_advmss + 40 : 0),
- fi->fib_window,
- fi->fib_rtt >> 3, &len);
+ len = seq_printf(seq, "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
+ (fi->fib_dev ?
+ fi->fib_dev->name : "*"),
+ prefix,
+ fi->fib_nh->nh_gw, flags,
+ 0, 0, fi->fib_priority, mask,
+ (fi->fib_advmss ?
+ fi->fib_advmss + 40 : 0),
+ fi->fib_window,
+ fi->fib_rtt >> 3);
else
- seq_printf(seq,
- "*\t%08X\t%08X\t%04X\t%d\t%u\t"
- "%d\t%08X\t%d\t%u\t%u%n",
- prefix, 0, flags, 0, 0, 0,
- mask, 0, 0, 0, &len);
+ len = seq_printf(seq, "*\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u",
+ prefix, 0, flags, 0, 0, 0,
+ mask, 0, 0, 0);
seq_printf(seq, "%*s\n", 127 - len, "");
}
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index d7d9882..ac8d79f 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -1081,16 +1081,15 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
__u16 destp = ntohs(inet->inet_dport);
__u16 srcp = ntohs(inet->inet_sport);
- seq_printf(f, "%5d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d%n",
- bucket, src, srcp, dest, destp, sp->sk_state,
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0,
- from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
- 0, sock_i_ino(sp),
- atomic_read(&sp->sk_refcnt), sp,
- atomic_read(&sp->sk_drops), len);
+ *len = seq_printf(f, "%5d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d",
+ bucket, src, srcp, dest, destp, sp->sk_state,
+ sk_wmem_alloc_get(sp),
+ sk_rmem_alloc_get(sp),
+ 0, 0L, 0,
+ from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
+ 0, sock_i_ino(sp),
+ atomic_read(&sp->sk_refcnt), sp,
+ atomic_read(&sp->sk_drops));
}
static int ping_v4_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b14266b..1279c16 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2603,24 +2603,24 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
const struct inet_request_sock *ireq = inet_rsk(req);
long delta = req->expires - jiffies;
- seq_printf(f, "%4d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK%n",
- i,
- ireq->loc_addr,
- ntohs(inet_sk(sk)->inet_sport),
- ireq->rmt_addr,
- ntohs(ireq->rmt_port),
- TCP_SYN_RECV,
- 0, 0, /* could print option size, but that is af dependent. */
- 1, /* timers active (only the expire timer) */
- jiffies_delta_to_clock_t(delta),
- req->num_timeout,
- from_kuid_munged(seq_user_ns(f), uid),
- 0, /* non standard timer */
- 0, /* open_requests have no inode */
- atomic_read(&sk->sk_refcnt),
- req,
- len);
+ *len = seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK",
+ i,
+ ireq->loc_addr,
+ ntohs(inet_sk(sk)->inet_sport),
+ ireq->rmt_addr,
+ ntohs(ireq->rmt_port),
+ TCP_SYN_RECV,
+ 0, 0, /* could print option size,
+ * but that is af dependent.
+ */
+ 1, /* timers active (only the expire timer) */
+ jiffies_delta_to_clock_t(delta),
+ req->num_timeout,
+ from_kuid_munged(seq_user_ns(f), uid),
+ 0, /* non standard timer */
+ 0, /* open_requests have no inode */
+ atomic_read(&sk->sk_refcnt),
+ req);
}
static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
@@ -2661,26 +2661,25 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
*/
rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
- seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
- "%08X %5u %8d %lu %d %pK %lu %lu %u %u %d%n",
- i, src, srcp, dest, destp, sk->sk_state,
- tp->write_seq - tp->snd_una,
- rx_queue,
- timer_active,
- jiffies_delta_to_clock_t(timer_expires - jiffies),
- icsk->icsk_retransmits,
- from_kuid_munged(seq_user_ns(f), sock_i_uid(sk)),
- icsk->icsk_probes_out,
- sock_i_ino(sk),
- atomic_read(&sk->sk_refcnt), sk,
- jiffies_to_clock_t(icsk->icsk_rto),
- jiffies_to_clock_t(icsk->icsk_ack.ato),
- (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
- tp->snd_cwnd,
- sk->sk_state == TCP_LISTEN ?
- (fastopenq ? fastopenq->max_qlen : 0) :
- (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh),
- len);
+ *len = seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d",
+ i, src, srcp, dest, destp, sk->sk_state,
+ tp->write_seq - tp->snd_una,
+ rx_queue,
+ timer_active,
+ jiffies_delta_to_clock_t(timer_expires - jiffies),
+ icsk->icsk_retransmits,
+ from_kuid_munged(seq_user_ns(f), sock_i_uid(sk)),
+ icsk->icsk_probes_out,
+ sock_i_ino(sk),
+ atomic_read(&sk->sk_refcnt), sk,
+ jiffies_to_clock_t(icsk->icsk_rto),
+ jiffies_to_clock_t(icsk->icsk_ack.ato),
+ (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
+ tp->snd_cwnd,
+ sk->sk_state == TCP_LISTEN ?
+ (fastopenq ? fastopenq->max_qlen : 0) :
+ (tcp_in_initial_slowstart(tp) ? -1 :
+ tp->snd_ssthresh));
}
static void get_timewait4_sock(const struct inet_timewait_sock *tw,
@@ -2695,11 +2694,10 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
destp = ntohs(tw->tw_dport);
srcp = ntohs(tw->tw_sport);
- seq_printf(f, "%4d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
- i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
- 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
- atomic_read(&tw->tw_refcnt), tw, len);
+ *len = seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK",
+ i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
+ 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
+ atomic_read(&tw->tw_refcnt), tw);
}
#define TMPSZ 150
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 74d2c95..ddc24a2d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2158,16 +2158,15 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
__u16 destp = ntohs(inet->inet_dport);
__u16 srcp = ntohs(inet->inet_sport);
- seq_printf(f, "%5d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d%n",
- bucket, src, srcp, dest, destp, sp->sk_state,
- sk_wmem_alloc_get(sp),
- sk_rmem_alloc_get(sp),
- 0, 0L, 0,
- from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
- 0, sock_i_ino(sp),
- atomic_read(&sp->sk_refcnt), sp,
- atomic_read(&sp->sk_drops), len);
+ *len = seq_printf(f, "%5d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d",
+ bucket, src, srcp, dest, destp, sp->sk_state,
+ sk_wmem_alloc_get(sp),
+ sk_rmem_alloc_get(sp),
+ 0, 0L, 0,
+ from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
+ 0, sock_i_ino(sp),
+ atomic_read(&sp->sk_refcnt), sp,
+ atomic_read(&sp->sk_drops));
}
int udp4_seq_show(struct seq_file *seq, void *v)
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 77e38f7..553f896 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -598,21 +598,20 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
int len;
if (v == SEQ_START_TOKEN)
- seq_printf(seq, "%s%n", "pt loc rem rs st tx_queue rx_queue "
- " uid inode ref pointer drops", &len);
+ len = seq_puts(seq, "pt loc rem rs st tx_queue rx_queue uid inode ref pointer drops");
else {
struct sock *sk = v;
struct pn_sock *pn = pn_sk(sk);
- seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu "
- "%d %pK %d%n",
- sk->sk_protocol, pn->sobject, pn->dobject,
- pn->resource, sk->sk_state,
- sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
- from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
- sock_i_ino(sk),
- atomic_read(&sk->sk_refcnt), sk,
- atomic_read(&sk->sk_drops), &len);
+ len = seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %lu %d %pK %d",
+ sk->sk_protocol, pn->sobject, pn->dobject,
+ pn->resource, sk->sk_state,
+ sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
+ from_kuid_munged(seq_user_ns(seq),
+ sock_i_uid(sk)),
+ sock_i_ino(sk),
+ atomic_read(&sk->sk_refcnt), sk,
+ atomic_read(&sk->sk_drops));
}
seq_printf(seq, "%*s\n", 127 - len, "");
return 0;
@@ -788,15 +787,16 @@ static int pn_res_seq_show(struct seq_file *seq, void *v)
int len;
if (v == SEQ_START_TOKEN)
- seq_printf(seq, "%s%n", "rs uid inode", &len);
+ len = seq_puts(seq, "rs uid inode");
else {
struct sock **psk = v;
struct sock *sk = *psk;
- seq_printf(seq, "%02X %5u %lu%n",
- (int) (psk - pnres.sk),
- from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
- sock_i_ino(sk), &len);
+ len = seq_printf(seq, "%02X %5u %lu",
+ (int) (psk - pnres.sk),
+ from_kuid_munged(seq_user_ns(seq),
+ sock_i_uid(sk)),
+ sock_i_ino(sk));
}
seq_printf(seq, "%*s\n", 63 - len, "");
return 0;
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 5ea573b..8034325 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -82,8 +82,9 @@ static int sctp_objcnt_seq_show(struct seq_file *seq, void *v)
int i, len;
i = (int)*(loff_t *)v;
- seq_printf(seq, "%s: %d%n", sctp_dbg_objcnt[i].label,
- atomic_read(sctp_dbg_objcnt[i].counter), &len);
+ len = seq_printf(seq, "%s: %d",
+ sctp_dbg_objcnt[i].label,
+ atomic_read(sctp_dbg_objcnt[i].counter));
seq_printf(seq, "%*s\n", 127 - len, "");
return 0;
}
--
1.8.1.2.459.gbcd45b4.dirty
^ permalink raw reply related
* Re: [PATCH] ipv6: Do route updating for redirect in ndisc layer
From: Hannes Frederic Sowa @ 2013-09-11 23:17 UTC (permalink / raw)
To: Duan Jiong; +Cc: davem, netdev, dborkman, vyasevich
In-Reply-To: <52301603.7030906@cn.fujitsu.com>
[added Cc to Daniel and Vlad because of ipv6/sctp/redirect problem]
On Wed, Sep 11, 2013 at 03:04:35PM +0800, Duan Jiong wrote:
> 于 2013年09月11日 06:50, Hannes Frederic Sowa 写道:
> > On Mon, Sep 09, 2013 at 03:09:56PM +0800, Duan Jiong wrote:
> >> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> >> index 5c71501..61fe8e5 100644
> >> --- a/net/ipv6/tcp_ipv6.c
> >> +++ b/net/ipv6/tcp_ipv6.c
> >> @@ -382,14 +382,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
> >>
> >> np = inet6_sk(sk);
> >>
> >> - if (type == NDISC_REDIRECT) {
> >> - struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
> >> -
> >> - if (dst)
> >> - dst->ops->redirect(dst, sk, skb);
> >> - goto out;
> >> - }
> >> -
> >
> > You dropped the "goto out" here in case of an NDISC_REDIRECT, so this sends an
> > EPROTO further up the socket layer. Was this intended?
> >
>
> I'm sorry, i didn't notice the variable err was assigned to EPROTO.
> I only thought that message should be sent to the socket layer, because
> i found that in function sctp_v6_err().
>
> In addition, the rfc 4443 said the Redirect Message is not the ICMPv6 Error
> Message, so i think we shouldn't call those err_handler function, in other
> words we shouldn't call the icmpv6_notify().
>
> How do you think of this?
Hm, thats hard.
First of, when the kernel started publishing these errors it had a
contract with user-space we cannot break now. This includes all error
handling functions which call ipv6_icmp_error. So we only have to care
about INET6_PROTO_FINAL protocols, bbecause they mostly operate in socket
space (in this case these are the raw and the udp protocol and currently
sctp). Especially I do think it is important to report the redirects
to raw sockets. The other non-final protocols only need to be notified
for mtu reduction currently. Maybe we could stop notifying non-final
protocols for redirects, but I don't think this will improve things.
Also we cannot know if the router sending the redirect discarded the
original packet or if it forwarded it just notifying us of a better route,
so we don't know if an actual error happend. So I would do the same thing
as IPv4 sockets, set sk_err to zero and queue up the icmp packet on the
socket's error queue (for udp and raw).
Regarding notifying tcp sockets about the redirect seems wrong. It would
generate a poll notification and I do think it could even tear down
the whole connection. I guess sctp should also stop updating sk_err
on redirects. But let's Cc Daniel and Vlad about this. My guess is that
sctp could go into some error recovery mode because of this which would
be wrong.
So, for this patch I would leave the logic as is and not change anything
at the error reporting. Maybe Daniel and Vlad could check if we should
suppress redirect information for ipv6 in sctp, too? But this should
go into another patch. Regarding the EPROTO problem in raw and udp,
let's see if all the problems go away if we update icmpv6_err_convert
to set *err to 0.
Greetings,
Hannes
^ permalink raw reply
* Re: [PATCH net 1/1] r8169: enforce RX_MULTI_EN for the 8168f.
From: Francois Romieu @ 2013-09-11 23:15 UTC (permalink / raw)
To: David Miller; +Cc: dborkman, netdev, david, fredo, hayeswang
In-Reply-To: <20130911.161606.1575635427616463157.davem@davemloft.net>
David Miller <davem@davemloft.net> :
[...]
> Francois, if you reply to this thread with your signoff, all will
> be well and I will apply this.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
I slowly built an AMD IOMMU + 8168{e/f} problem report pattern but
the picture got blurred:
- Hayes has not heard of anything like this
- the oracle suggests it could be an "AMD IOMMU + whatever" problem
- "iommu=pt" seems quite effective (hardly surprizing :o/ )
I still have a pile of iommu mailing-list messages to search through.
Let aside the AMD-Vi error log message, I haven't done a thorough analysis.
It's lame.
--
Ueimor
^ permalink raw reply
* Re: [PATCH 01/52] net: typhoon: remove unnecessary pci_set_drvdata()
From: David Dillow @ 2013-09-11 22:18 UTC (permalink / raw)
To: Jingoo Han; +Cc: 'David S. Miller', netdev
In-Reply-To: <004b01ceaebf$7e7e0e20$7b7a2a60$%han@samsung.com>
On Wed, 2013-09-11 at 16:21 +0900, Jingoo Han wrote:
> The driver core clears the driver data to NULL after device_release
> or on probe failure. Thus, it is not needed to manually clear the
> device driver data to NULL.
>
> Signed-off-by: Jingoo Han <jg1.han@samsung.com>
For what it is worth,
Acked-by: David Dillow <dave@thedillows.org>
^ permalink raw reply
* Re: [net v7 0/8][pull request] Intel Wired LAN Driver Updates
From: Jeff Kirsher @ 2013-09-11 22:08 UTC (permalink / raw)
To: David Miller; +Cc: e1000-devel, netdev, jesse.brandeburg, gospo, sassmann
In-Reply-To: <20130911.170807.48801927112532333.davem@davemloft.net>
[-- Attachment #1.1: Type: text/plain, Size: 446 bytes --]
On Wed, 2013-09-11 at 17:08 -0400, David Miller wrote:
> From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
> Date: Wed, 11 Sep 2013 02:50:48 -0700
>
> > git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net master
>
> Ok, I've pulled this.
>
> Please send fixups based upon the trivial issues a few folks have
> pointed out.
>
> Thanks.
Noted, we are already working on the fixups based on the feedback.
Thanks,
Jeff
[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
[-- Attachment #2: Type: text/plain, Size: 407 bytes --]
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
[-- Attachment #3: Type: text/plain, Size: 257 bytes --]
_______________________________________________
E1000-devel mailing list
E1000-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/e1000-devel
To learn more about Intel® Ethernet, visit http://communities.intel.com/community/wired
^ permalink raw reply
* From Mrs Monat Adama.
From: monat @ 2013-09-11 21:42 UTC (permalink / raw)
Dear Friend,
Greetings to you and your family.
My name is Mrs Monate Adama, the current Chief Auditor of a formidable bank here in Ouagadougou, Burkina Faso, West Africa. I have a transaction worth of 12.5 Million U.S dollars for transferring into your care for our mutual benefits, so i need your assistance with 100% cooperation to realise this task.
Further details about the fund, its source and the administrative procedure to transfer this fund into your receiving bank account shall be made known to you immediately as I have your positive response.
Thanks and Regards,
Mrs Monate Adama.
^ permalink raw reply
* [GIT] Networking
From: David Miller @ 2013-09-11 21:25 UTC (permalink / raw)
To: torvalds; +Cc: akpm, netdev, linux-kernel
1) Brown paper bag fix in HTB scheduler, class options set incorrectly due
to a typoe. Fix from Vimalkumar.
2) It's possible for the ipv6 FIB garbage collector to run before all
the necessary datastructure are setup during init, defer the notifier
registry to avoid this problem. Fix from Michal Kubecek.
3) New i40e ethernet driver from the Intel folks.
4) Add new qmi wwan device IDs, from Bjørn Mork.
5) Doorbell lock in bnx2x driver is not initialized properly in some
configurations, fix from Ariel Elior.
6) Revert an ipv6 packet option padding change that broke standardized
ipv6 implementation test suites. From Jiri Pirko.
7) Fix synchronization of ARP information in bonding layer, from Nikolay
Aleksandrov.
8) Fix missing error return resulting in illegal memory accesses in
openvswitch, from Daniel Borkmann.
9) SCTP doesn't signal poll events properly due to mistaken operator
precedence, fix also from Daniel Borkmann.
10) __netdev_pick_tx() passes wrong index to sk_tx_queue_set() which
essentially disables caching of TX queue in sockets :-/ Fix from
Eric Dumazet.
Please pull, thanks a lot!
The following changes since commit 300893b08f3bc7057a7a5f84074090ba66c8b5ca:
Merge tag 'xfs-for-linus-v3.12-rc1' of git://oss.sgi.com/xfs/xfs (2013-09-09 11:19:09 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git master
for you to fetch changes up to f3ad857e3da1abaea780dc892b592cd86c541c52:
net_sched: htb: fix a typo in htb_change_class() (2013-09-11 17:16:22 -0400)
----------------------------------------------------------------
Ariel Elior (1):
bnx2x: Fix configuration of doorbell block
Bjørn Mork (1):
net: qmi_wwan: add new Qualcomm devices
Chris Metcalf (1):
net: tilegx driver: avoid compiler warning
Daniel Borkmann (4):
net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs
net: fib: fib6_add: fix potential NULL pointer dereference
net: sctp: fix bug in sctp_poll for SOCK_SELECT_ERR_QUEUE
net: sctp: fix smatch warning in sctp_send_asconf_del_ip
David S. Miller (2):
Merge branch 'bonding_arp'
Merge branch 'master' of git://git.kernel.org/.../jkirsher/net
Eric Dumazet (1):
net: fix multiqueue selection
Herbert Xu (1):
macvlan: Move skb_clone check closer to call
Jesse Brandeburg (8):
i40e: main driver core
i40e: transmit, receive, and NAPI
i40e: driver ethtool core
i40e: driver core headers
i40e: implement virtual device interface
i40e: init code and hardware support
i40e: debugfs interface
i40e: include i40e in kernel proper
Jingoo Han (2):
irda: donauboe: Remove casting the return value which is a void pointer
irda: vlsi_ir: Remove casting the return value which is a void pointer
Jiri Pirko (1):
ipv6/exthdrs: accept tlv which includes only padding
Jitendra Kalsaria (1):
qlcnic: Fix warning reported by kbuild test robot.
Michael Opdenacker (2):
net: korina: remove deprecated IRQF_DISABLED
bcm63xx_enet: remove deprecated IRQF_DISABLED
Michal Kubeček (1):
ipv6: don't call fib6_run_gc() until routing is ready
Michal Schmidt (1):
bnx2x: avoid atomic allocations during initialization
Stefan Tomanek (1):
fib6_rules: fix indentation
Vimalkumar (1):
net_sched: htb: fix a typo in htb_change_class()
nikolay@redhat.com (2):
bonding: fix store_arp_validate race with mode change
bonding: fix bond_arp_rcv setting and arp validate desync state
Documentation/networking/00-INDEX | 2 +
Documentation/networking/i40e.txt | 115 ++
MAINTAINERS | 3 +-
drivers/net/bonding/bond_main.c | 4 +-
drivers/net/bonding/bond_sysfs.c | 31 +-
drivers/net/bonding/bonding.h | 1 +
drivers/net/ethernet/broadcom/bcm63xx_enet.c | 8 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 38 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 3 -
drivers/net/ethernet/intel/Kconfig | 18 +
drivers/net/ethernet/intel/Makefile | 1 +
drivers/net/ethernet/intel/i40e/Makefile | 44 +
drivers/net/ethernet/intel/i40e/i40e.h | 558 ++++++
drivers/net/ethernet/intel/i40e/i40e_adminq.c | 983 ++++++++++
drivers/net/ethernet/intel/i40e/i40e_adminq.h | 112 ++
drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2076 +++++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_alloc.h | 59 +
drivers/net/ethernet/intel/i40e/i40e_common.c | 2041 ++++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2076 +++++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_diag.c | 131 ++
drivers/net/ethernet/intel/i40e/i40e_diag.h | 52 +
drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 1449 +++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_hmc.c | 366 ++++
drivers/net/ethernet/intel/i40e/i40e_hmc.h | 245 +++
drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c | 1006 ++++++++++
drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h | 169 ++
drivers/net/ethernet/intel/i40e/i40e_main.c | 7375 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_nvm.c | 391 ++++
drivers/net/ethernet/intel/i40e/i40e_osdep.h | 82 +
drivers/net/ethernet/intel/i40e/i40e_prototype.h | 239 +++
drivers/net/ethernet/intel/i40e/i40e_register.h | 4688 ++++++++++++++++++++++++++++++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_status.h | 101 +
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 1817 ++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_txrx.h | 259 +++
drivers/net/ethernet/intel/i40e/i40e_type.h | 1154 ++++++++++++
drivers/net/ethernet/intel/i40e/i40e_virtchnl.h | 368 ++++
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2335 +++++++++++++++++++++++
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 120 ++
drivers/net/ethernet/korina.c | 8 +-
drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 2 +-
drivers/net/ethernet/tile/tilegx.c | 6 +-
drivers/net/irda/donauboe.c | 6 +-
drivers/net/irda/vlsi_ir.c | 2 +-
drivers/net/macvlan.c | 10 +-
drivers/net/usb/qmi_wwan.c | 130 +-
include/net/ndisc.h | 2 +
net/core/flow_dissector.c | 2 +-
net/ipv6/af_inet6.c | 6 +
net/ipv6/exthdrs.c | 6 -
net/ipv6/fib6_rules.c | 4 +-
net/ipv6/ip6_fib.c | 2 +-
net/ipv6/ndisc.c | 18 +-
net/openvswitch/flow.c | 1 +
net/sched/sch_htb.c | 2 +-
net/sctp/socket.c | 5 +-
56 files changed, 30666 insertions(+), 67 deletions(-)
create mode 100644 Documentation/networking/i40e.txt
create mode 100644 drivers/net/ethernet/intel/i40e/Makefile
create mode 100644 drivers/net/ethernet/intel/i40e/i40e.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_adminq.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_adminq.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_alloc.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_common.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_debugfs.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_diag.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_diag.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_ethtool.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_hmc.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_hmc.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_main.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_nvm.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_osdep.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_prototype.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_register.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_status.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_txrx.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_txrx.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_type.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_virtchnl.h
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
create mode 100644 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
^ permalink raw reply
* Re: [PATCH] net_sched: htb: fix a typo in htb_change_class()
From: David Miller @ 2013-09-11 21:17 UTC (permalink / raw)
To: jiri; +Cc: eric.dumazet, netdev, brouer, j.vimal, jpirko
In-Reply-To: <20130911055827.GB1404@minipsycho.orion>
From: Jiri Pirko <jiri@resnulli.us>
Date: Wed, 11 Sep 2013 07:58:27 +0200
> Wed, Sep 11, 2013 at 02:36:37AM CEST, eric.dumazet@gmail.com wrote:
>>From: Vimalkumar <j.vimal@gmail.com>
>>
>>Fix a typo added in commit 56b765b79 ("htb: improved accuracy at high
>>rates")
>>
>>cbuffer should not be a copy of buffer.
>>
>>Signed-off-by: Vimalkumar <j.vimal@gmail.com>
>>Signed-off-by: Eric Dumazet <edumazet@google.com>
>>Cc: Jesper Dangaard Brouer <brouer@redhat.com>
>>Cc: Jiri Pirko <jpirko@redhat.com>
> Reviewed-by: Jiri Pirko <jiri@resnulli.us>
Applied and queued up for -stable, thanks everyone.
^ permalink raw reply
* Re: [PATCH] net: qmi_wwan: add new Qualcomm devices
From: David Miller @ 2013-09-11 21:15 UTC (permalink / raw)
To: bjorn; +Cc: netdev, linux-usb, scateu
In-Reply-To: <1378818380-5255-1-git-send-email-bjorn@mork.no>
From: Bjørn Mork <bjorn@mork.no>
Date: Tue, 10 Sep 2013 15:06:20 +0200
> Adding the device list from the Windows driver description files
> included with a new Qualcomm MDM9615 based device, "Alcatel-sbell
> ASB TL131 TDD LTE", from China Mobile. This device is tested
> and verified to work. The others are assumed to work based on
> using the same Windows driver.
>
> Many of these devices support multiple QMI/wwan ports, requiring
> multiple interface matching entries. All devices are composite,
> providing a mix of one or more serial, storage or Android Debug
> Brigde functions in addition to the wwan function.
>
> This device list included an update of one previously known device,
> which was incorrectly assumed to have a Gobi 2K layout. This is
> corrected.
>
> Reported-by: 王康 <scateu@gmail.com>
> Signed-off-by: Bjørn Mork <bjorn@mork.no>
Applied, thank you.
^ permalink raw reply
* Re: [net v7 0/8][pull request] Intel Wired LAN Driver Updates
From: David Miller @ 2013-09-11 21:08 UTC (permalink / raw)
To: jeffrey.t.kirsher
Cc: netdev, gospo, sassmann, jesse.brandeburg, shannon.nelson,
peter.p.waskiewicz.jr, e1000-devel
In-Reply-To: <1378893056-4821-1-git-send-email-jeffrey.t.kirsher@intel.com>
From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Date: Wed, 11 Sep 2013 02:50:48 -0700
> git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net master
Ok, I've pulled this.
Please send fixups based upon the trivial issues a few folks have
pointed out.
Thanks.
^ permalink raw reply
* Re: [PATCH net] ipv6: don't call fib6_run_gc() until routing is ready
From: David Miller @ 2013-09-11 21:05 UTC (permalink / raw)
To: mkubecek; +Cc: netdev, kuznet, jmorris, yoshfuji, kaber
In-Reply-To: <20130909194504.1C691E5E72@unicorn.suse.cz>
From: Michal Kubecek <mkubecek@suse.cz>
Date: Mon, 9 Sep 2013 21:45:04 +0200 (CEST)
> When loading the ipv6 module, ndisc_init() is called before
> ip6_route_init(). As the former registers a handler calling
> fib6_run_gc(), this opens a window to run the garbage collector
> before necessary data structures are initialized. If a network
> device is initialized in this window, adding MAC address to it
> triggers a NETDEV_CHANGEADDR event, leading to a crash in
> fib6_clean_all().
>
> Take the event handler registration out of ndisc_init() into a
> separate function ndisc_late_init() and move it after
> ip6_route_init().
>
> Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Looks good, applied, thanks.
^ permalink raw reply
* Re: [PATCH] net: tilegx driver: avoid compiler warning
From: David Miller @ 2013-09-11 20:58 UTC (permalink / raw)
To: cmetcalf; +Cc: netdev, linux-kernel
In-Reply-To: <201309091822.r89IMXmA032018@farm-0002.internal.tilera.com>
From: Chris Metcalf <cmetcalf@tilera.com>
Date: Mon, 9 Sep 2013 14:11:54 -0400
> The "id" variable was being incremented in common code, but only
> initialized and used in IPv4 code. We move the increment to the IPv4
> code too, and then legitimately use the uninitialized_var() macro to
> avoid the gcc 4.6 warning that 'id' may be used uninitialized.
> Note that gcc 4.7 does not warn.
>
> Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
Ugly situation, but whatever, applied :-)
^ permalink raw reply
* Re: [PATCH 1/1] bridge: fix message_age_timer calculation
From: David Miller @ 2013-09-11 20:48 UTC (permalink / raw)
To: sergei.shtylyov; +Cc: stephen, netdev, bridge, buytenh
In-Reply-To: <5230B93B.3040900@cogentembedded.com>
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Date: Wed, 11 Sep 2013 22:40:59 +0400
> Hello.
>
> On 09/09/2013 08:56 PM, Chris Healy wrote:
>
>> This changes the message_age_timer calculation to use the BPDU's max
>> age as opposed to the local bridge's max age. This is in accordance
>> with section 8.6.2.3.2 Step 2 of the 802.1D-1998 sprecification.
>
> You should wrap your changelog lines at 80 chars at most, preferably
> less.
Yes, please fix this and resubmit.
^ permalink raw reply
* Re: [PATCH] fib6_rules: fix indentation
From: David Miller @ 2013-09-11 20:16 UTC (permalink / raw)
To: stefan.tomanek; +Cc: netdev
In-Reply-To: <20130908150943.GR21970@zirkel.wertarbyte.de>
From: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
Date: Sun, 8 Sep 2013 17:09:43 +0200
> This change just removes two tabs from the source file.
>
> Signed-off-by: Stefan Tomanek <stefan.tomanek@wertarbyte.de>
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net 1/1] r8169: enforce RX_MULTI_EN for the 8168f.
From: David Miller @ 2013-09-11 20:16 UTC (permalink / raw)
To: dborkman; +Cc: romieu, netdev, david, fredo, hayeswang
In-Reply-To: <522C391A.3020408@redhat.com>
From: Daniel Borkmann <dborkman@redhat.com>
Date: Sun, 08 Sep 2013 10:45:14 +0200
> On 09/08/2013 01:15 AM, Francois Romieu wrote:
>> Same narrative as eb2dc35d99028b698cdedba4f5522bc43e576bd2 ("r8169:
>> RxConfig
>> hack for the 8168evl.") regarding AMD IOMMU errors.
>>
>> RTL_GIGA_MAC_VER_36 - 8168f as well - has not been reported to behave
>> the
>> same.
>>
>> Tested-by: David R <david@unsolicited.net>
>> Tested-by: Frédéric Leroy <fredo@starox.org>
>> Cc: Hayes Wang <hayeswang@realtek.com>
>> ---
>
> Your signed-off-by is missing.
Francois, if you reply to this thread with your signoff, all will
be well and I will apply this.
Thanks.
^ permalink raw reply
* Re: [PATCH] bcm63xx_enet: remove deprecated IRQF_DISABLED
From: David Miller @ 2013-09-11 20:15 UTC (permalink / raw)
To: michael.opdenacker; +Cc: jogo, joe, jg1.han, mbizon, netdev, linux-kernel
In-Reply-To: <1378537010-7128-1-git-send-email-michael.opdenacker@free-electrons.com>
From: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Date: Sat, 7 Sep 2013 08:56:50 +0200
> This patch proposes to remove the IRQF_DISABLED flag from
> drivers/net/ethernet/broadcom/bcm63xx_enet.c
>
> It's a NOOP since 2.6.35 and it will be removed one day.
>
> Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Applied.
^ permalink raw reply
* Re: [PATCH] net: korina: remove deprecated IRQF_DISABLED
From: David Miller @ 2013-09-11 20:14 UTC (permalink / raw)
To: michael.opdenacker
Cc: emilio, mugunthanvnm, jg1.han, hsweeten, netdev, linux-kernel
In-Reply-To: <1378531257-5446-1-git-send-email-michael.opdenacker@free-electrons.com>
From: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Date: Sat, 7 Sep 2013 07:20:57 +0200
> This patch proposes to remove the IRQF_DISABLED flag from
> drivers/net/ethernet/korina.c
>
> It's a NOOP since 2.6.35 and it will be removed one day.
>
> Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Applied.
^ permalink raw reply
* Re: [PATCH net] net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs
From: David Miller @ 2013-09-11 20:14 UTC (permalink / raw)
To: jesse; +Cc: dborkman, netdev, azhou, dev
In-Reply-To: <CAEP_g=_Bgt8OsORTyYRt=tbssfbd-0Jh2HhnjPdj1aVP8Zd1BA@mail.gmail.com>
From: Jesse Gross <jesse@nicira.com>
Date: Sat, 7 Sep 2013 22:35:33 -0700
> On Sat, Sep 7, 2013 at 12:41 AM, Daniel Borkmann <dborkman@redhat.com> wrote:
>> In function __parse_flow_nlattrs(), we check for condition
>> (type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
>> not return from this function as in other checks. It seems this
>> has been forgotten, as otherwise, we could access beyond the
>> memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
>> Hence, a maliciously prepared nla_type from user space could access
>> beyond this upper limit.
>>
>> Introduced by 03f0d916a ("openvswitch: Mega flow implementation").
>>
>> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
>> Cc: Andy Zhou <azhou@nicira.com>
>
> Yeah, looks like a mistake to me.
>
> Acked-by: Jesse Gross <jesse@nicira.com>
Applied, thanks.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox