* [PATCH] staging: r8188eu: Fix AP mode
From: Larry Finger @ 2013-11-17 19:28 UTC (permalink / raw)
To: gregkh; +Cc: devel, netdev, Stable, Larry Finger
Two code lines were accidentally deleted in the code. Restore them.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
---
drivers/staging/rtl8188eu/core/rtw_ap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 2c73823..2a13a41 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -1115,6 +1115,9 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
return _FAIL;
}
+ /* fix bug of flush_cam_entry at STOP AP mode */
+ psta->state |= WIFI_AP_STATE;
+ rtw_indicate_connect(padapter);
pmlmepriv->cur_network.join_res = true;/* for check if already set beacon */
return ret;
}
--
1.8.4
^ permalink raw reply related
* [PATCH V2] staging: r8188eu: Fix AP mode
From: Larry Finger @ 2013-11-17 19:32 UTC (permalink / raw)
To: gregkh; +Cc: netdev, devel, Larry Finger, Stable
Two code lines were accidentally deleted. Restore them.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
---
V2 - rewrite silly commit message.
drivers/staging/rtl8188eu/core/rtw_ap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 2c73823..2a13a41 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -1115,6 +1115,9 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
return _FAIL;
}
+ /* fix bug of flush_cam_entry at STOP AP mode */
+ psta->state |= WIFI_AP_STATE;
+ rtw_indicate_connect(padapter);
pmlmepriv->cur_network.join_res = true;/* for check if already set beacon */
return ret;
}
--
1.8.4
^ permalink raw reply related
* Re: kernel BUG at net/core/skbuff.c:2839 RIP [<ffffffff819109a2>] skb_segment+0x6b2/0x6d0
From: Cong Wang @ 2013-11-17 19:59 UTC (permalink / raw)
To: netdev
In-Reply-To: <1287049824.20131117201744@eikelenboom.it>
On Sun, 17 Nov 2013 at 19:17 GMT, Sander Eikelenboom <linux@eikelenboom.it> wrote:
> Hi Eric,
>
> With the linux-net changes from this merge window i get the kernel panic below (not with 3.12.0).
>
> It's on a machine running Xen, 2x rtl8169 nic, and using a bridge for guest networking.
> This panic in the host kernel only seems to occur when generating a lot of network traffic to and from a guest.
>
> I tried reverting "tcp: gso: fix truesize tracking" 0d08c42cf9a71530fef5ebcfe368f38f2dd0476f, but that didn't help.
>
> --
> Sander
>
> [ 1164.511712] ------------[ cut here ]------------
> [ 1164.518446] kernel BUG at net/core/skbuff.c:2839!
This is discussed in another long thread:
http://marc.info/?t=138419721200049&r=1&w=2
^ permalink raw reply
* Re: [PATCH net-next] veth: extend features to support tunneling
From: Or Gerlitz @ 2013-11-17 21:20 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Eric Dumazet, David Miller, Eric Dumazet, Stephen Hemminger,
netdev@vger.kernel.org, Michael S. Tsirkin, John Fastabend
In-Reply-To: <CAMEtUuw1VUtafKVnBOKAy+rNyKDYnDsst8ygwqEtKX75w96Q-w@mail.gmail.com>
On Sun, Nov 17, 2013 , Alexei Starovoitov <ast@plumgrid.com> wrote:
> On Sun, Nov 17, 2013 , Eric Dumazet <eric.dumazet@gmail.com> wrote:
>> On Sat, 2013-11-16 , Alexei Starovoitov wrote:
>>> In case of VMs sending gso packets over tap and tunnel in the host,
>>> ip_forward is not in the picture.
>> I was specifically answering to #2 which should use ip forwarding, of
>> course. Note that my patch was a POC : We have many other places where
>> the typical MTU check is simply disabled as soon as skb is GSO.
> I don't think #2 will do ip_forward either. veth goes into a bridge
> and vxlan just adds encap.
Eric, do we have concensus here that this #2 of veth --> bridge -->
vxlan --> NIC will not go through ip_forward?!
Anyway, I tried your patch and didn't see notable improvement on my
tests. The tests I did few days ago were over 3.10.19 to have more
stable ground... moving to 3.12.0 and net-next today, the baseline
performance became worse, in the sense that if a bit of simplified env
of bridge --> vxlan --> NIC with many iperf client threads yielded
similar throughput as vxlan --> NIC or bridge --> NIC, with net-next
its not the case. If you have 10Gbs or 40Gbs NICs, even without HW TCP
offloads for VXLAN, you might be able to see that on your setups.
^ permalink raw reply
* Re: [RFC 2/8] drop_monitor/genetlink: use proper genetlink multicast APIs
From: Neil Horman @ 2013-11-17 22:14 UTC (permalink / raw)
To: Johannes Berg; +Cc: netdev, Johannes Berg
In-Reply-To: <1384621429-24543-3-git-send-email-johannes@sipsolutions.net>
On Sat, Nov 16, 2013 at 06:03:43PM +0100, Johannes Berg wrote:
> From: Johannes Berg <johannes.berg@intel.com>
>
> The drop monitor code is abusing the genetlink API and is
> statically using the generic netlink multicast group 1, even
> if that group belongs to somebody else (which it invariably
> will, since it's not reserved.)
>
> Make the drop monitor code use the proper APIs to reserve a
> group ID, but also reserve the group id 1 in generic netlink
> code to preserve the userspace API. Since drop monitor can
> be a module, don't clear the bit for it on unregistration.
>
> Cc: Neil Horman <nhorman@tuxdriver.com>
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
> ---
> net/core/drop_monitor.c | 13 ++++++++++++-
> net/netlink/genetlink.c | 13 ++++++++++---
> 2 files changed, 22 insertions(+), 4 deletions(-)
>
> diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
> index 0efc502..46ee488 100644
> --- a/net/core/drop_monitor.c
> +++ b/net/core/drop_monitor.c
> @@ -106,6 +106,10 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
> return skb;
> }
>
> +static struct genl_multicast_group dm_mcgrp = {
> + .name = "events",
> +};
> +
> static void send_dm_alert(struct work_struct *work)
> {
> struct sk_buff *skb;
> @@ -116,7 +120,7 @@ static void send_dm_alert(struct work_struct *work)
> skb = reset_per_cpu_data(data);
>
> if (skb)
> - genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
> + genlmsg_multicast(skb, 0, dm_mcgrp.id, GFP_KERNEL);
> }
>
> /*
> @@ -371,6 +375,13 @@ static int __init init_net_drop_monitor(void)
> return rc;
> }
>
> + rc = genl_register_mc_group(&net_drop_monitor_family, &dm_mcgrp);
> + if (rc) {
> + pr_err("Failed to register drop monitor mcast group\n");
> + goto out_unreg;
> + }
> + WARN_ON(dm_mcgrp.id != NET_DM_GRP_ALERT);
> +
> rc = register_netdevice_notifier(&dropmon_net_notifier);
> if (rc < 0) {
> pr_crit("Failed to register netdevice notifier\n");
> diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
> index 2b57aee..8a2ed2c 100644
> --- a/net/netlink/genetlink.c
> +++ b/net/netlink/genetlink.c
> @@ -65,8 +65,12 @@ static struct list_head family_ht[GENL_FAM_TAB_SIZE];
> * To avoid an allocation at boot of just one unsigned long,
> * declare it global instead.
> * Bit 0 is marked as already used since group 0 is invalid.
> + * Bit 1 is marked as already used since the drop-monitor code
> + * abuses the API and thinks it can statically use group 1.
> + * That group will typically conflict with other groups that
> + * any proper users use.
> */
> -static unsigned long mc_group_start = 0x1;
> +static unsigned long mc_group_start = 0x3;
> static unsigned long *mc_groups = &mc_group_start;
> static unsigned long mc_groups_longs = 1;
>
> @@ -160,9 +164,11 @@ int genl_register_mc_group(struct genl_family *family,
>
> genl_lock_all();
>
> - /* special-case our own group */
> + /* special-case our own group and hacks */
> if (grp == ¬ify_grp)
> id = GENL_ID_CTRL;
> + else if (strcmp(family->name, "NET_DM") == 0)
> + id = 1;
> else
> id = find_first_zero_bit(mc_groups,
> mc_groups_longs * BITS_PER_LONG);
> @@ -245,7 +251,8 @@ static void __genl_unregister_mc_group(struct genl_family *family,
> rcu_read_unlock();
> netlink_table_ungrab();
>
> - clear_bit(grp->id, mc_groups);
> + if (grp->id != 1)
> + clear_bit(grp->id, mc_groups);
> list_del(&grp->list);
> genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
> grp->id = 0;
> --
> 1.8.4.rc3
>
>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Thanks Johannes!
Neil
^ permalink raw reply
* Re: [PATCH net-next] veth: extend features to support tunneling
From: Eric Dumazet @ 2013-11-17 22:38 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Or Gerlitz, David Miller, Eric Dumazet, Stephen Hemminger,
netdev@vger.kernel.org, Michael S. Tsirkin, John Fastabend
In-Reply-To: <CAMEtUuw1VUtafKVnBOKAy+rNyKDYnDsst8ygwqEtKX75w96Q-w@mail.gmail.com>
On Sun, 2013-11-17 at 11:00 -0800, Alexei Starovoitov wrote:
> On Sun, Nov 17, 2013 at 9:20 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > On Sat, 2013-11-16 at 23:31 -0800, Alexei Starovoitov wrote:
> >
> >> In case of VMs sending gso packets over tap and tunnel in the host,
> >> ip_forward is not in the picture.
> >>
> >
> > I was specifically answering to #2 which should use ip forwarding, of
> > course. Note that my patch was a POC : We have many other places where
> > the typical MTU check is simply disabled as soon as skb is GSO.
>
> I don't think #2 will do ip_forward either. veth goes into a bridge
> and vxlan just adds encap.
The point is : nothing really checks mtu for gso packets.
Same construct was copy/pasted everywhere. See br_dev_queue_push_xmit()
for another example.
In this particular case, I guess vxlan should generate the ICMP.
But really, its Sunday and I currently do not care ;)
^ permalink raw reply
* Re: [PATCH v2] tcp: tsq: restore minimal amount of queueing
From: Francois Romieu @ 2013-11-17 23:15 UTC (permalink / raw)
To: Holger Hoffstaette; +Cc: netdev
In-Reply-To: <pan.2013.11.13.23.52.41.470832@googlemail.com>
Holger Hoffstaette <holger.hoffstaette@googlemail.com> :
[...]
> Since I saw this with r8169->r8169 and e1000e->r8169 it's probably
> everyone's favourite r8169 :)
> Unfortunately I can't be more help but if you can suggest/whip up a fix
> I'd be happy to help test.
The r8169 driver does not rely on a timer for Tx completion.
The patch below should not hurt.
Can you describe your system a bit more specifically ?
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 3397cee..7280d5d 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6393,12 +6393,12 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
status = rtl_get_events(tp);
rtl_ack_events(tp, status & ~tp->event_slow);
- if (status & RTL_EVENT_NAPI_RX)
- work_done = rtl_rx(dev, tp, (u32) budget);
-
if (status & RTL_EVENT_NAPI_TX)
rtl_tx(dev, tp);
+ if (status & RTL_EVENT_NAPI_RX)
+ work_done = rtl_rx(dev, tp, (u32) budget);
+
if (status & tp->event_slow) {
enable_mask &= ~tp->event_slow;
^ permalink raw reply related
* Re: [PATCH v3] net: Do not include padding in TCP GRO checksum
From: Herbert Xu @ 2013-11-18 0:03 UTC (permalink / raw)
To: Alexander Duyck; +Cc: Alexander Duyck, davem, netdev, edumazet
In-Reply-To: <528909E4.1000100@gmail.com>
On Sun, Nov 17, 2013 at 10:24:36AM -0800, Alexander Duyck wrote:
>
> It seems like it would be much more likely that a checksum error
> occuring with a padded frame would corrupt the flow identifying data
> then one that isn't padded.
Well it doesn't matter anyway because if a packet has an incorrect
checksum it'll be dropped by the receiving stack anyway so a little
reordering is not going to do any harm. After all, to be 100%
correct, you'd have to flush every single flow between those IP
addresses which is just silly.
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply
* [PATCH] Revert "af-packet: Use existing netdev reference for bound sockets."
From: Salam Noureddine @ 2013-11-18 0:28 UTC (permalink / raw)
To: David S. Miller, Daniel Borkmann, Willem de Bruijn, Phil Sutter,
Eric Dumazet, netdev
Cc: Salam Noureddine
This reverts commit 827d978037d7d0bf0860481948c6d26ead10042f.
The patch introduced a race condition between packet_snd and packet_notifier
when a net_device is being unregistered. In the case of a bound socket,
packet_notifier can drop the last reference to the net_device and packet_snd
might be sending a packet over a freed net_device.
---
net/packet/af_packet.c | 27 ++++++++++++---------------
1 files changed, 12 insertions(+), 15 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2e8286b..a7335ae 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2057,8 +2057,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
struct sk_buff *skb;
struct net_device *dev;
__be16 proto;
- bool need_rls_dev = false;
- int err, reserve = 0;
+ int ifindex, err, reserve = 0;
void *ph;
struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
int tp_len, size_max;
@@ -2070,7 +2069,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
mutex_lock(&po->pg_vec_lock);
if (saddr == NULL) {
- dev = po->prot_hook.dev;
+ ifindex = po->ifindex;
proto = po->num;
addr = NULL;
} else {
@@ -2081,12 +2080,12 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ offsetof(struct sockaddr_ll,
sll_addr)))
goto out;
+ ifindex = saddr->sll_ifindex;
proto = saddr->sll_protocol;
addr = saddr->sll_addr;
- dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
- need_rls_dev = true;
}
+ dev = dev_get_by_index(sock_net(&po->sk), ifindex);
err = -ENXIO;
if (unlikely(dev == NULL))
goto out;
@@ -2173,8 +2172,7 @@ out_status:
__packet_set_status(po, ph, status);
kfree_skb(skb);
out_put:
- if (need_rls_dev)
- dev_put(dev);
+ dev_put(dev);
out:
mutex_unlock(&po->pg_vec_lock);
return err;
@@ -2212,9 +2210,8 @@ static int packet_snd(struct socket *sock,
struct sk_buff *skb;
struct net_device *dev;
__be16 proto;
- bool need_rls_dev = false;
unsigned char *addr;
- int err, reserve = 0;
+ int ifindex, err, reserve = 0;
struct virtio_net_hdr vnet_hdr = { 0 };
int offset = 0;
int vnet_hdr_len;
@@ -2228,7 +2225,7 @@ static int packet_snd(struct socket *sock,
*/
if (saddr == NULL) {
- dev = po->prot_hook.dev;
+ ifindex = po->ifindex;
proto = po->num;
addr = NULL;
} else {
@@ -2237,12 +2234,13 @@ static int packet_snd(struct socket *sock,
goto out;
if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
goto out;
+ ifindex = saddr->sll_ifindex;
proto = saddr->sll_protocol;
addr = saddr->sll_addr;
- dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
- need_rls_dev = true;
}
+
+ dev = dev_get_by_index(sock_net(sk), ifindex);
err = -ENXIO;
if (dev == NULL)
goto out_unlock;
@@ -2386,15 +2384,14 @@ static int packet_snd(struct socket *sock,
if (err > 0 && (err = net_xmit_errno(err)) != 0)
goto out_unlock;
- if (need_rls_dev)
- dev_put(dev);
+ dev_put(dev);
return len;
out_free:
kfree_skb(skb);
out_unlock:
- if (dev && need_rls_dev)
+ if (dev)
dev_put(dev);
out:
return err;
--
1.7.4.4
^ permalink raw reply related
* RE: [PATCH 1/4] net/phy: Add VSC8234 support
From: Shruti @ 2013-11-18 0:55 UTC (permalink / raw)
To: David Miller, f.fainelli@gmail.com
Cc: Shruti@freescale.com, netdev@vger.kernel.org, afleming@gmail.com,
galak@kernel.crashing.org
In-Reply-To: <20131115.210921.1205089932014239868.davem@davemloft.net>
Hello David,
> -----Original Message-----
> From: David Miller [mailto:davem@davemloft.net]
> Sent: Friday, November 15, 2013 8:09 PM
> To: f.fainelli@gmail.com
> Cc: Kanetkar Shruti-B44454; netdev@vger.kernel.org; afleming@gmail.com;
> galak@kernel.crashing.org
> Subject: Re: [PATCH 1/4] net/phy: Add VSC8234 support
>
> From: Florian Fainelli <f.fainelli@gmail.com>
> Date: Fri, 15 Nov 2013 18:04:36 -0800
>
> > 2013/11/15 David Miller <davem@davemloft.net>:
> >>
> >> These patches didn't actually make it to the netdev list, so they
> >> were not queued up in patchwork.
How can I fix this?
Should I resend them?
> >
> > Are you sure about them not making it to netdev? marc.info also has
> > the 4 of them here:
> >
> > http://marc.info/?l=linux-netdev&m=138455632228947&w=2
> > http://marc.info/?l=linux-netdev&m=138455632828949&w=2
> > http://marc.info/?l=linux-netdev&m=138455633228950&w=2
> > http://marc.info/?l=linux-netdev&m=138455633628952&w=2
>
> More specifically I meant that they didn't end up in patchwork,
> which is what actually matters for my workflow.
Regards,
Shruti
^ permalink raw reply
* Re: [PATCH] Revert "af-packet: Use existing netdev reference for bound sockets."
From: David Miller @ 2013-11-18 2:28 UTC (permalink / raw)
To: noureddine; +Cc: dborkman, willemb, phil, edumazet, netdev
In-Reply-To: <1384734522-36613-1-git-send-email-noureddine@aristanetworks.com>
From: Salam Noureddine <noureddine@aristanetworks.com>
Date: Sun, 17 Nov 2013 16:28:42 -0800
> This reverts commit 827d978037d7d0bf0860481948c6d26ead10042f.
>
> The patch introduced a race condition between packet_snd and packet_notifier
> when a net_device is being unregistered. In the case of a bound socket,
> packet_notifier can drop the last reference to the net_device and packet_snd
> might be sending a packet over a freed net_device.
You need to provide a proper "Signed-off-by: ", you need to refer to
commits not just buy SHA1 ID but also by the commit header text in
parenthesis and double quotes.
^ permalink raw reply
* [PATCH 1/3] vhost: remove the dead branch
From: Zhi Yong Wu @ 2013-11-18 3:19 UTC (permalink / raw)
To: netdev; +Cc: mst, rusty, Zhi Yong Wu
From: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Since vhost_dev_init() forever return 0, some branches are never run,
therefore need to be removed.
Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
---
drivers/vhost/net.c | 5 -----
drivers/vhost/scsi.c | 5 -----
drivers/vhost/test.c | 5 -----
3 files changed, 0 insertions(+), 15 deletions(-)
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 831eb4f..0554785 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -707,11 +707,6 @@ static int vhost_net_open(struct inode *inode, struct file *f)
n->vqs[i].sock_hlen = 0;
}
r = vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
- if (r < 0) {
- kfree(n);
- kfree(vqs);
- return r;
- }
vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, POLLOUT, dev);
vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, POLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index e663921..9d5e18d 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1421,14 +1421,9 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
tcm_vhost_init_inflight(vs, NULL);
- if (r < 0)
- goto err_init;
-
f->private_data = vs;
return 0;
-err_init:
- kfree(vqs);
err_vqs:
vhost_scsi_free(vs);
err_vs:
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 339eae8..99cb960 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -118,11 +118,6 @@ static int vhost_test_open(struct inode *inode, struct file *f)
vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ];
n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick;
r = vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX);
- if (r < 0) {
- kfree(vqs);
- kfree(n);
- return r;
- }
f->private_data = n;
--
1.7.6.5
^ permalink raw reply related
* [PATCH 2/3] vhost: adjust vhost_dev_init() to be void
From: Zhi Yong Wu @ 2013-11-18 3:19 UTC (permalink / raw)
To: netdev; +Cc: mst, rusty, Zhi Yong Wu
In-Reply-To: <1384744763-7476-1-git-send-email-zwu.kernel@gmail.com>
From: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
---
drivers/vhost/net.c | 4 ++--
drivers/vhost/scsi.c | 2 +-
drivers/vhost/test.c | 3 +--
drivers/vhost/vhost.c | 4 +---
drivers/vhost/vhost.h | 2 +-
5 files changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 0554785..9a68409 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -683,7 +683,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
struct vhost_net *n = kmalloc(sizeof *n, GFP_KERNEL);
struct vhost_dev *dev;
struct vhost_virtqueue **vqs;
- int r, i;
+ int i;
if (!n)
return -ENOMEM;
@@ -706,7 +706,7 @@ static int vhost_net_open(struct inode *inode, struct file *f)
n->vqs[i].vhost_hlen = 0;
n->vqs[i].sock_hlen = 0;
}
- r = vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
+ vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, POLLOUT, dev);
vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, POLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9d5e18d..e02b7df 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1417,7 +1417,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
vqs[i] = &vs->vqs[i].vq;
vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
}
- r = vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+ vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
tcm_vhost_init_inflight(vs, NULL);
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 99cb960..c2a54fb 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -104,7 +104,6 @@ static int vhost_test_open(struct inode *inode, struct file *f)
struct vhost_test *n = kmalloc(sizeof *n, GFP_KERNEL);
struct vhost_dev *dev;
struct vhost_virtqueue **vqs;
- int r;
if (!n)
return -ENOMEM;
@@ -117,7 +116,7 @@ static int vhost_test_open(struct inode *inode, struct file *f)
dev = &n->dev;
vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ];
n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick;
- r = vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX);
+ vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX);
f->private_data = n;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 69068e0..78987e4 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -290,7 +290,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
vhost_vq_free_iovecs(dev->vqs[i]);
}
-long vhost_dev_init(struct vhost_dev *dev,
+void vhost_dev_init(struct vhost_dev *dev,
struct vhost_virtqueue **vqs, int nvqs)
{
struct vhost_virtqueue *vq;
@@ -319,8 +319,6 @@ long vhost_dev_init(struct vhost_dev *dev,
vhost_poll_init(&vq->poll, vq->handle_kick,
POLLIN, dev);
}
-
- return 0;
}
EXPORT_SYMBOL_GPL(vhost_dev_init);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 4465ed5..35eeb2a 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -127,7 +127,7 @@ struct vhost_dev {
struct task_struct *worker;
};
-long vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
long vhost_dev_set_owner(struct vhost_dev *dev);
bool vhost_dev_has_owner(struct vhost_dev *dev);
long vhost_dev_check_owner(struct vhost_dev *);
--
1.7.6.5
^ permalink raw reply related
* [PATCH 3/3] vhost: fix the wrong log descriptions
From: Zhi Yong Wu @ 2013-11-18 3:19 UTC (permalink / raw)
To: netdev; +Cc: mst, rusty, Zhi Yong Wu
In-Reply-To: <1384744763-7476-1-git-send-email-zwu.kernel@gmail.com>
From: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com>
---
drivers/vhost/vhost.c | 2 +-
drivers/vhost/vringh.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 78987e4..568d20f 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1241,7 +1241,7 @@ int vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
/* If their number is silly, that's an error. */
if (unlikely(head >= vq->num)) {
- vq_err(vq, "Guest says index %u > %u is available",
+ vq_err(vq, "Guest says index %u > %u is unavailable",
head, vq->num);
return -EINVAL;
}
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 5174eba..86ef6c4 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -57,7 +57,7 @@ static inline int __vringh_get_head(const struct vringh *vrh,
}
if (head >= vrh->vring.num) {
- vringh_bad("Guest says index %u > %u is available",
+ vringh_bad("Guest says index %u > %u is unavailable",
head, vrh->vring.num);
return -EINVAL;
}
--
1.7.6.5
^ permalink raw reply related
* [PATCH v4] inet: prevent leakage of uninitialized memory to user in recv syscalls
From: Hannes Frederic Sowa @ 2013-11-18 3:20 UTC (permalink / raw)
To: Eric Dumazet, mpb, netdev
In-Reply-To: <20131117192240.GI16541@order.stressinduktion.org>
Only update *addr_len when we actually fill in sockaddr, otherwise we
can return uninitialized memory from the stack to the caller in the
recvfrom, recvmmsg and recvmsg syscalls. Drop the the (addr_len == NULL)
checks because we only get called with a valid addr_len pointer either
from sock_common_recvmsg or inet_recvmsg.
If a blocking read waits on a socket which is concurrently shut down we
now return zero and set msg_msgnamelen to 0.
Reported-by: mpb <mpb.mail@gmail.com>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
This is the first round, fixing the callees of sock_common_recvmsg and
inet_recvmsg. I guess there are some more problems of this kind with
recvmsg called directly via proto_ops->recvmsg. I will have a look at
them in the next days.
We could actually leave out filling in msg_name if the user didn't request
(src_addr == NULL in recvfrom). I'll put this on my TODO for net-next.
Also it is possible to just update msg->msg_namelen directly here and simplify
sock_common_recvmsg and inet_recvmsg, also for net-next.
Greetings,
Hannes
net/ieee802154/dgram.c | 3 +--
net/ipv4/ping.c | 19 +++++++------------
net/ipv4/raw.c | 4 +---
net/ipv4/udp.c | 7 +------
net/ipv6/raw.c | 4 +---
net/ipv6/udp.c | 5 +----
net/l2tp/l2tp_ip.c | 4 +---
net/phonet/datagram.c | 9 ++++-----
8 files changed, 17 insertions(+), 38 deletions(-)
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 581a595..1865fdf 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -315,9 +315,8 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
if (saddr) {
saddr->family = AF_IEEE802154;
saddr->addr = mac_cb(skb)->sa;
- }
- if (addr_len)
*addr_len = sizeof(*saddr);
+ }
if (flags & MSG_TRUNC)
copied = skb->len;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 9afbdb1..aacefa0 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -830,8 +830,6 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
{
struct inet_sock *isk = inet_sk(sk);
int family = sk->sk_family;
- struct sockaddr_in *sin;
- struct sockaddr_in6 *sin6;
struct sk_buff *skb;
int copied, err;
@@ -841,13 +839,6 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
if (flags & MSG_OOB)
goto out;
- if (addr_len) {
- if (family == AF_INET)
- *addr_len = sizeof(*sin);
- else if (family == AF_INET6 && addr_len)
- *addr_len = sizeof(*sin6);
- }
-
if (flags & MSG_ERRQUEUE) {
if (family == AF_INET) {
return ip_recv_error(sk, msg, len);
@@ -877,11 +868,13 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
/* Copy the address and add cmsg data. */
if (family == AF_INET) {
- sin = (struct sockaddr_in *) msg->msg_name;
+ struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+
sin->sin_family = AF_INET;
sin->sin_port = 0 /* skb->h.uh->source */;
sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+ *addr_len = sizeof(*sin);
if (isk->cmsg_flags)
ip_cmsg_recv(msg, skb);
@@ -890,17 +883,19 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
} else if (family == AF_INET6) {
struct ipv6_pinfo *np = inet6_sk(sk);
struct ipv6hdr *ip6 = ipv6_hdr(skb);
- sin6 = (struct sockaddr_in6 *) msg->msg_name;
+ struct sockaddr_in6 *sin6 =
+ (struct sockaddr_in6 *)msg->msg_name;
+
sin6->sin6_family = AF_INET6;
sin6->sin6_port = 0;
sin6->sin6_addr = ip6->saddr;
-
sin6->sin6_flowinfo = 0;
if (np->sndflow)
sin6->sin6_flowinfo = ip6_flowinfo(ip6);
sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
IP6CB(skb)->iif);
+ *addr_len = sizeof(*sin6);
if (inet6_sk(sk)->rxopt.all)
pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 41e1d28..5cb8ddb 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -696,9 +696,6 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
if (flags & MSG_OOB)
goto out;
- if (addr_len)
- *addr_len = sizeof(*sin);
-
if (flags & MSG_ERRQUEUE) {
err = ip_recv_error(sk, msg, len);
goto out;
@@ -726,6 +723,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
sin->sin_port = 0;
memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+ *addr_len = sizeof(*sin);
}
if (inet->cmsg_flags)
ip_cmsg_recv(msg, skb);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 89909dd..998431c 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1235,12 +1235,6 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
int is_udplite = IS_UDPLITE(sk);
bool slow;
- /*
- * Check any passed addresses
- */
- if (addr_len)
- *addr_len = sizeof(*sin);
-
if (flags & MSG_ERRQUEUE)
return ip_recv_error(sk, msg, len);
@@ -1302,6 +1296,7 @@ try_again:
sin->sin_port = udp_hdr(skb)->source;
sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+ *addr_len = sizeof(*sin);
}
if (inet->cmsg_flags)
ip_cmsg_recv(msg, skb);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 3c00842..e24ff1d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -465,9 +465,6 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
if (flags & MSG_OOB)
return -EOPNOTSUPP;
- if (addr_len)
- *addr_len=sizeof(*sin6);
-
if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len);
@@ -506,6 +503,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
sin6->sin6_flowinfo = 0;
sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
IP6CB(skb)->iif);
+ *addr_len = sizeof(*sin6);
}
sock_recv_ts_and_drops(msg, sk, skb);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f3893e8..81eb8cf 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -392,9 +392,6 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
int is_udp4;
bool slow;
- if (addr_len)
- *addr_len = sizeof(struct sockaddr_in6);
-
if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len);
@@ -480,7 +477,7 @@ try_again:
ipv6_iface_scope_id(&sin6->sin6_addr,
IP6CB(skb)->iif);
}
-
+ *addr_len = sizeof(*sin6);
}
if (is_udp4) {
if (inet->cmsg_flags)
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 571db8d..da1a1ce 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -518,9 +518,6 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
if (flags & MSG_OOB)
goto out;
- if (addr_len)
- *addr_len = sizeof(*sin);
-
skb = skb_recv_datagram(sk, flags, noblock, &err);
if (!skb)
goto out;
@@ -543,6 +540,7 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
sin->sin_port = 0;
memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+ *addr_len = sizeof(*sin);
}
if (inet->cmsg_flags)
ip_cmsg_recv(msg, skb);
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index 12c30f3..38946b2 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -139,9 +139,6 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
MSG_CMSG_COMPAT))
goto out_nofree;
- if (addr_len)
- *addr_len = sizeof(sa);
-
skb = skb_recv_datagram(sk, flags, noblock, &rval);
if (skb == NULL)
goto out_nofree;
@@ -162,8 +159,10 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
rval = (flags & MSG_TRUNC) ? skb->len : copylen;
- if (msg->msg_name != NULL)
- memcpy(msg->msg_name, &sa, sizeof(struct sockaddr_pn));
+ if (msg->msg_name != NULL) {
+ memcpy(msg->msg_name, &sa, sizeof(sa));
+ *addr_len = sizeof(sa);
+ }
out:
skb_free_datagram(sk, skb);
--
1.8.3.1
^ permalink raw reply related
* Re: [PATCH] Revert "af-packet: Use existing netdev reference for bound sockets."
From: Salam Noureddine @ 2013-11-18 5:06 UTC (permalink / raw)
To: David Miller
Cc: Daniel Borkmann, Willem de Bruijn, Phil Sutter, Eric Dumazet,
netdev
In-Reply-To: <20131117.212812.2002429039119385634.davem@davemloft.net>
Will fix it. Thanks.
On Sun, Nov 17, 2013 at 6:28 PM, David Miller <davem@davemloft.net> wrote:
> From: Salam Noureddine <noureddine@aristanetworks.com>
> Date: Sun, 17 Nov 2013 16:28:42 -0800
>
>> This reverts commit 827d978037d7d0bf0860481948c6d26ead10042f.
>>
>> The patch introduced a race condition between packet_snd and packet_notifier
>> when a net_device is being unregistered. In the case of a bound socket,
>> packet_notifier can drop the last reference to the net_device and packet_snd
>> might be sending a packet over a freed net_device.
>
> You need to provide a proper "Signed-off-by: ", you need to refer to
> commits not just buy SHA1 ID but also by the commit header text in
> parenthesis and double quotes.
^ permalink raw reply
* [PATCH 1/1] Revert "af-packet: Use existing netdev reference for bound sockets"
From: Salam Noureddine @ 2013-11-18 5:32 UTC (permalink / raw)
To: David S. Miller, Daniel Borkmann, Willem de Bruijn, Phil Sutter,
Eric Dumazet, netdev
Cc: Salam Noureddine
From: Salam Noureddine <noureddine@bs324.sjc.aristanetworks.com>
This reverts commit 827d978037d7d0bf0860481948c6d26ead10042f
("af-packet: Use existing netdev reference for bound sockets")
The patch introduced a race condition between packet_snd and
packet_notifier when a net_device is being unregistered. In the case of
a bound socket, packet_notifier can drop the last reference to the
net_device and packet_snd might end up sending a packet over a freed
net_device.
Signed-off-by: Salam Noureddine <noureddine@bs324.sjc.aristanetworks.com>
---
net/packet/af_packet.c | 26 +++++++++++---------------
1 files changed, 11 insertions(+), 15 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2e8286b..34fe9eb 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2057,8 +2057,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
struct sk_buff *skb;
struct net_device *dev;
__be16 proto;
- bool need_rls_dev = false;
- int err, reserve = 0;
+ int ifindex, err, reserve = 0;
void *ph;
struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
int tp_len, size_max;
@@ -2070,7 +2069,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
mutex_lock(&po->pg_vec_lock);
if (saddr == NULL) {
- dev = po->prot_hook.dev;
+ ifindex = po->ifindex;
proto = po->num;
addr = NULL;
} else {
@@ -2081,12 +2080,12 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ offsetof(struct sockaddr_ll,
sll_addr)))
goto out;
+ ifindex = saddr->sll_ifindex;
proto = saddr->sll_protocol;
addr = saddr->sll_addr;
- dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
- need_rls_dev = true;
}
+ dev = dev_get_by_index(sock_net(&po->sk), ifindex);
err = -ENXIO;
if (unlikely(dev == NULL))
goto out;
@@ -2173,8 +2172,7 @@ out_status:
__packet_set_status(po, ph, status);
kfree_skb(skb);
out_put:
- if (need_rls_dev)
- dev_put(dev);
+ dev_put(dev);
out:
mutex_unlock(&po->pg_vec_lock);
return err;
@@ -2212,9 +2210,8 @@ static int packet_snd(struct socket *sock,
struct sk_buff *skb;
struct net_device *dev;
__be16 proto;
- bool need_rls_dev = false;
unsigned char *addr;
- int err, reserve = 0;
+ int ifindex, err, reserve = 0;
struct virtio_net_hdr vnet_hdr = { 0 };
int offset = 0;
int vnet_hdr_len;
@@ -2228,7 +2225,7 @@ static int packet_snd(struct socket *sock,
*/
if (saddr == NULL) {
- dev = po->prot_hook.dev;
+ ifindex = po->ifindex;
proto = po->num;
addr = NULL;
} else {
@@ -2237,12 +2234,12 @@ static int packet_snd(struct socket *sock,
goto out;
if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
goto out;
+ ifindex = saddr->sll_ifindex;
proto = saddr->sll_protocol;
addr = saddr->sll_addr;
- dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
- need_rls_dev = true;
}
+ dev = dev_get_by_index(sock_net(sk), ifindex);
err = -ENXIO;
if (dev == NULL)
goto out_unlock;
@@ -2386,15 +2383,14 @@ static int packet_snd(struct socket *sock,
if (err > 0 && (err = net_xmit_errno(err)) != 0)
goto out_unlock;
- if (need_rls_dev)
- dev_put(dev);
+ dev_put(dev);
return len;
out_free:
kfree_skb(skb);
out_unlock:
- if (dev && need_rls_dev)
+ if (dev)
dev_put(dev);
out:
return err;
--
1.7.4.4
^ permalink raw reply related
* [PATCH] ping: prevent NULL pointer dereference on write to msg_name
From: Hannes Frederic Sowa @ 2013-11-18 6:07 UTC (permalink / raw)
To: netdev
A plain read() on a socket does set msg->msg_name to NULL. So check for
NULL pointer first.
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
Addendum to "[v4] inet: prevent leakage of uninitialized memory to user in
recv syscalls".
net/ipv4/ping.c | 34 +++++++++++++++++++---------------
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index aacefa0..91bfe04 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -870,11 +870,13 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
if (family == AF_INET) {
struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
- sin->sin_family = AF_INET;
- sin->sin_port = 0 /* skb->h.uh->source */;
- sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
- memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
- *addr_len = sizeof(*sin);
+ if (sin) {
+ sin->sin_family = AF_INET;
+ sin->sin_port = 0 /* skb->h.uh->source */;
+ sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+ memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+ *addr_len = sizeof(*sin);
+ }
if (isk->cmsg_flags)
ip_cmsg_recv(msg, skb);
@@ -886,16 +888,18 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
struct sockaddr_in6 *sin6 =
(struct sockaddr_in6 *)msg->msg_name;
- sin6->sin6_family = AF_INET6;
- sin6->sin6_port = 0;
- sin6->sin6_addr = ip6->saddr;
- sin6->sin6_flowinfo = 0;
- if (np->sndflow)
- sin6->sin6_flowinfo = ip6_flowinfo(ip6);
-
- sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
- IP6CB(skb)->iif);
- *addr_len = sizeof(*sin6);
+ if (sin6) {
+ sin6->sin6_family = AF_INET6;
+ sin6->sin6_port = 0;
+ sin6->sin6_addr = ip6->saddr;
+ sin6->sin6_flowinfo = 0;
+ if (np->sndflow)
+ sin6->sin6_flowinfo = ip6_flowinfo(ip6);
+ sin6->sin6_scope_id =
+ ipv6_iface_scope_id(&sin6->sin6_addr,
+ IP6CB(skb)->iif);
+ *addr_len = sizeof(*sin6);
+ }
if (inet6_sk(sk)->rxopt.all)
pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
--
1.8.3.1
^ permalink raw reply related
* Re: [ovs-dev] [PATCH v2.50 1/6] ofp-actions: Consider L4 actions after mpls_push as inconsistent
From: Simon Horman @ 2013-11-18 6:38 UTC (permalink / raw)
To: Ben Pfaff
Cc: Jarno Rajahalme, dev@openvswitch.org, netdev@vger.kernel.org,
Jesse Gross, Ravi K
In-Reply-To: <20131115174530.GE18635@nicira.com>
On Fri, Nov 15, 2013 at 09:45:30AM -0800, Ben Pfaff wrote:
> Thanks Simon, thanks Jarno, applied.
Thanks.
^ permalink raw reply
* Re: how to mix bridges and bonding inc. vlans correctly on Kernel > 3.10
From: Stefan Priebe - Profihost AG @ 2013-11-18 7:37 UTC (permalink / raw)
To: Vladislav Yasevich; +Cc: Veaceslav Falico, Vlad Yasevich, Linux Netdev List
In-Reply-To: <CAGCdqXEQwHy_q+qWQf9oYTkr0v_HXLY-nudjW=4ghYpB+o3H1w@mail.gmail.com>
Am 17.11.2013 04:41, schrieb Vladislav Yasevich:
> On Sat, Nov 16, 2013 at 4:02 PM, Stefan Priebe <s.priebe@profihost.ag> wrote:
>> Am 14.11.2013 22:13, schrieb Vlad Yasevich:
>>
>>> On 11/14/2013 07:29 AM, Veaceslav Falico wrote:
>>>>
>>>> On Thu, Nov 14, 2013 at 08:47:28AM +0100, Stefan Priebe - Profihost AG
>>>> wrote:
>>>>>
>>>>> Hi,
>>>>>
>>>>>> eth2
>>>>>> \
>>>>>> -- bond1 -- vmbr1
>>>>>> / \
>>>>>> eth3 ----- bond1.3000 --- vmbr1v3000
>>>>>> \ ---- tap114i1
>>>>>
>>>>>
>>>>> thos one works fine now.
>>>>>
>>>>>
>>>>>> eth2
>>>>>> \
>>>>>> -- bond1 -- vmbr1
>>>>>> / \
>>>>>> eth3 \ vmbr1.3000
>>>>>> \ ---- tap114i1
>>>>>
>>>>>
>>>>> this one does not. Another note to this one. It also never worked on
>>>>> RHEL6 - it started working with about 2.6.39 and stopped with 3.9 or
>>>>> 3.10. But it was the only one where gvrp on vlans had worked.
>>>>
>>>>
>>>> bridge device in this config is neither master nor slave, if I read it
>>>> correctly.
>>>
>>>
>>> Bridge doesn't propagate rx_flags to lower-level devices. It
>>> automatically set all lower devices to promisc mode.
>>>
>>> So, in the second case above, eth2 and eth3 have to be in promisc, but
>>> nothing else does. I am not sure I understand Stefans notation though
>>> wrt to how vmbr1.3000 and tap114i1 are configured. Stefan, can you
>>> elaborate?
>>
>>
>> Sorry . means vlan - so vmbr1.3000 is just a vlan on top of vmbr1. *brX is a
>> bridge. Bond is a lacp bond ;-)
>>
>
> Ok. I got that. But where is tap attached? You are showing it
> attached to the vlan,
> but you can't do that unless its a macvtap.
Why not? It was working until 3.9 - but with the patch in this thread
the first method adding a bridge on top of the bond works fine - so this
is OK for me too.
Greets,
Stefan
^ permalink raw reply
* [PATCH 1/1] Revert "af-packet: Use existing netdev reference for bound sockets"
From: Salam Noureddine @ 2013-11-18 7:40 UTC (permalink / raw)
To: David S. Miller, Daniel Borkmann, Willem de Bruijn, Phil Sutter,
Eric Dumazet, netdev
Cc: Salam Noureddine
This reverts commit 827d978037d7d0bf0860481948c6d26ead10042f
("af-packet: Use existing netdev reference for bound sockets")
The patch introduced a race condition between packet_snd and
packet_notifier when a net_device is being unregistered. In the case of
a bound socket, packet_notifier can drop the last reference to the
net_device and packet_snd might end up sending a packet over a freed
net_device.
Signed-off-by: Salam Noureddine <noureddine@aristanetworks.com>
---
net/packet/af_packet.c | 26 +++++++++++---------------
1 files changed, 11 insertions(+), 15 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2e8286b..34fe9eb 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2057,8 +2057,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
struct sk_buff *skb;
struct net_device *dev;
__be16 proto;
- bool need_rls_dev = false;
- int err, reserve = 0;
+ int ifindex, err, reserve = 0;
void *ph;
struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
int tp_len, size_max;
@@ -2070,7 +2069,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
mutex_lock(&po->pg_vec_lock);
if (saddr == NULL) {
- dev = po->prot_hook.dev;
+ ifindex = po->ifindex;
proto = po->num;
addr = NULL;
} else {
@@ -2081,12 +2080,12 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ offsetof(struct sockaddr_ll,
sll_addr)))
goto out;
+ ifindex = saddr->sll_ifindex;
proto = saddr->sll_protocol;
addr = saddr->sll_addr;
- dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
- need_rls_dev = true;
}
+ dev = dev_get_by_index(sock_net(&po->sk), ifindex);
err = -ENXIO;
if (unlikely(dev == NULL))
goto out;
@@ -2173,8 +2172,7 @@ out_status:
__packet_set_status(po, ph, status);
kfree_skb(skb);
out_put:
- if (need_rls_dev)
- dev_put(dev);
+ dev_put(dev);
out:
mutex_unlock(&po->pg_vec_lock);
return err;
@@ -2212,9 +2210,8 @@ static int packet_snd(struct socket *sock,
struct sk_buff *skb;
struct net_device *dev;
__be16 proto;
- bool need_rls_dev = false;
unsigned char *addr;
- int err, reserve = 0;
+ int ifindex, err, reserve = 0;
struct virtio_net_hdr vnet_hdr = { 0 };
int offset = 0;
int vnet_hdr_len;
@@ -2228,7 +2225,7 @@ static int packet_snd(struct socket *sock,
*/
if (saddr == NULL) {
- dev = po->prot_hook.dev;
+ ifindex = po->ifindex;
proto = po->num;
addr = NULL;
} else {
@@ -2237,12 +2234,12 @@ static int packet_snd(struct socket *sock,
goto out;
if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
goto out;
+ ifindex = saddr->sll_ifindex;
proto = saddr->sll_protocol;
addr = saddr->sll_addr;
- dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
- need_rls_dev = true;
}
+ dev = dev_get_by_index(sock_net(sk), ifindex);
err = -ENXIO;
if (dev == NULL)
goto out_unlock;
@@ -2386,15 +2383,14 @@ static int packet_snd(struct socket *sock,
if (err > 0 && (err = net_xmit_errno(err)) != 0)
goto out_unlock;
- if (need_rls_dev)
- dev_put(dev);
+ dev_put(dev);
return len;
out_free:
kfree_skb(skb);
out_unlock:
- if (dev && need_rls_dev)
+ if (dev)
dev_put(dev);
out:
return err;
--
1.7.4.4
^ permalink raw reply related
* Re: [PATCH 1/1] Revert "af-packet: Use existing netdev reference for bound sockets"
From: Salam Noureddine @ 2013-11-18 7:42 UTC (permalink / raw)
To: David S. Miller, Daniel Borkmann, Willem de Bruijn, Phil Sutter,
Eric Dumazet, netdev
In-Reply-To: <1384752728-37157-1-git-send-email-noureddine@aristanetworks.com>
Please ignore this version of the patch as it still has an issue with
the signed-off field. Already sent a corrected one.
Thanks,
Salam
On Sun, Nov 17, 2013 at 9:32 PM, Salam Noureddine
<noureddine@aristanetworks.com> wrote:
> From: Salam Noureddine <noureddine@bs324.sjc.aristanetworks.com>
>
> This reverts commit 827d978037d7d0bf0860481948c6d26ead10042f
> ("af-packet: Use existing netdev reference for bound sockets")
>
> The patch introduced a race condition between packet_snd and
> packet_notifier when a net_device is being unregistered. In the case of
> a bound socket, packet_notifier can drop the last reference to the
> net_device and packet_snd might end up sending a packet over a freed
> net_device.
>
> Signed-off-by: Salam Noureddine <noureddine@bs324.sjc.aristanetworks.com>
> ---
> net/packet/af_packet.c | 26 +++++++++++---------------
> 1 files changed, 11 insertions(+), 15 deletions(-)
>
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 2e8286b..34fe9eb 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -2057,8 +2057,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
> struct sk_buff *skb;
> struct net_device *dev;
> __be16 proto;
> - bool need_rls_dev = false;
> - int err, reserve = 0;
> + int ifindex, err, reserve = 0;
> void *ph;
> struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
> int tp_len, size_max;
> @@ -2070,7 +2069,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
> mutex_lock(&po->pg_vec_lock);
>
> if (saddr == NULL) {
> - dev = po->prot_hook.dev;
> + ifindex = po->ifindex;
> proto = po->num;
> addr = NULL;
> } else {
> @@ -2081,12 +2080,12 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
> + offsetof(struct sockaddr_ll,
> sll_addr)))
> goto out;
> + ifindex = saddr->sll_ifindex;
> proto = saddr->sll_protocol;
> addr = saddr->sll_addr;
> - dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
> - need_rls_dev = true;
> }
>
> + dev = dev_get_by_index(sock_net(&po->sk), ifindex);
> err = -ENXIO;
> if (unlikely(dev == NULL))
> goto out;
> @@ -2173,8 +2172,7 @@ out_status:
> __packet_set_status(po, ph, status);
> kfree_skb(skb);
> out_put:
> - if (need_rls_dev)
> - dev_put(dev);
> + dev_put(dev);
> out:
> mutex_unlock(&po->pg_vec_lock);
> return err;
> @@ -2212,9 +2210,8 @@ static int packet_snd(struct socket *sock,
> struct sk_buff *skb;
> struct net_device *dev;
> __be16 proto;
> - bool need_rls_dev = false;
> unsigned char *addr;
> - int err, reserve = 0;
> + int ifindex, err, reserve = 0;
> struct virtio_net_hdr vnet_hdr = { 0 };
> int offset = 0;
> int vnet_hdr_len;
> @@ -2228,7 +2225,7 @@ static int packet_snd(struct socket *sock,
> */
>
> if (saddr == NULL) {
> - dev = po->prot_hook.dev;
> + ifindex = po->ifindex;
> proto = po->num;
> addr = NULL;
> } else {
> @@ -2237,12 +2234,12 @@ static int packet_snd(struct socket *sock,
> goto out;
> if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
> goto out;
> + ifindex = saddr->sll_ifindex;
> proto = saddr->sll_protocol;
> addr = saddr->sll_addr;
> - dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
> - need_rls_dev = true;
> }
>
> + dev = dev_get_by_index(sock_net(sk), ifindex);
> err = -ENXIO;
> if (dev == NULL)
> goto out_unlock;
> @@ -2386,15 +2383,14 @@ static int packet_snd(struct socket *sock,
> if (err > 0 && (err = net_xmit_errno(err)) != 0)
> goto out_unlock;
>
> - if (need_rls_dev)
> - dev_put(dev);
> + dev_put(dev);
>
> return len;
>
> out_free:
> kfree_skb(skb);
> out_unlock:
> - if (dev && need_rls_dev)
> + if (dev)
> dev_put(dev);
> out:
> return err;
> --
> 1.7.4.4
>
^ permalink raw reply
* testing and validating 64-bit addressing.
From: Rayagond K @ 2013-11-18 7:57 UTC (permalink / raw)
To: netdev
Hi All,
I have one Ethernet card which supports 64-bit DMA addressing and I
need to implement this feature and test it.
I did following,
1. Implemented 64-but addressing ie changed driver to update the
descriptor start list address and buffer address into two 32-bit reg
(hig/low)
2. Enabled 64-bit addressing in device control reg.
3. Installed the 64-bit operating system on 64-bit architecture -
Fedora 15, 64 bit os , LINUX 3.8.0 kernel, Intel dual core processor,
4GB RAM.
4. And my Ethernet card is connected to HOST via PCIX.
With the above changes in the driver and test setup I am able to test
the 64-bit addressing and following are the observation made during
testing,
1. Tx/Rx descriptor address is 33-bit and same is updated correctly in
Tx/Rx desc list address low/high reg.
2. Tx/Rx buffer address is also 33-bit and same is updated correctly
in Tx/Rx desc buffer pointer low/high reg.
But I am not able to understand following,
1. Why are we always getting 33-bit address only ?
2. Can we configure OS such that it gives 64-bit address or more than
33-bit address ?
3. In case of SG list, all buffer addresses are 33-bit, why it is like
that ? Can we get mixed pointers with different width like 33-bits,
40-bit, 64-bit etc ?
Thanks
Rayagond
^ permalink raw reply
* bridge: flush br's address entry in fdb when remove the bridge dev
From: Ding Tianhong @ 2013-11-18 8:25 UTC (permalink / raw)
To: Stephen Hemminger, David S. Miller, bridge, Netdev
When the following commands are executed:
brctl addbr br0
ifconfig br0 hw ether <addr>
rmmod bridge
The calltrace will occur:
[ 563.312114] device eth1 left promiscuous mode
[ 563.312188] br0: port 1(eth1) entered disabled state
[ 563.468190] kmem_cache_destroy bridge_fdb_cache: Slab cache still has objects
[ 563.468197] CPU: 6 PID: 6982 Comm: rmmod Tainted: G O 3.12.0-0.7-default+ #9
[ 563.468199] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 563.468200] 0000000000000880 ffff88010f111e98 ffffffff814d1c92 ffff88010f111eb8
[ 563.468204] ffffffff81148efd ffff88010f111eb8 0000000000000000 ffff88010f111ec8
[ 563.468206] ffffffffa062a270 ffff88010f111ed8 ffffffffa063ac76 ffff88010f111f78
[ 563.468209] Call Trace:
[ 563.468218] [<ffffffff814d1c92>] dump_stack+0x6a/0x78
[ 563.468234] [<ffffffff81148efd>] kmem_cache_destroy+0xfd/0x100
[ 563.468242] [<ffffffffa062a270>] br_fdb_fini+0x10/0x20 [bridge]
[ 563.468247] [<ffffffffa063ac76>] br_deinit+0x4e/0x50 [bridge]
[ 563.468254] [<ffffffff810c7dc9>] SyS_delete_module+0x199/0x2b0
[ 563.468259] [<ffffffff814e0922>] system_call_fastpath+0x16/0x1b
[ 570.377958] Bridge firewalling registered
------------------------- cut here ---------------------------
The reason is that if the bridge dev's address is changed, the
br_fdb_change_mac_address() will add new address in fdb, but when
the bridge was removed, the address entry in the fdb did not free,
the bridge_fdb_cache still has objects when destroy the cache, Fix
this by flushing the bridge address entry when removing the bridge.
Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
---
net/bridge/br_if.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c41d5fb..baedc32 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -172,6 +172,10 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
del_nbp(p);
}
+ spin_lock_bh(&br->hash_lock);
+ fdb_delete_by_addr(br, br->dev->dev_addr, 0);
+ spin_unlock_bh(&br->hash_lock);
+
del_timer_sync(&br->gc_timer);
br_sysfs_delbr(br->dev);
--
1.7.12
^ permalink raw reply related
* [PATCH net] bridge: flush br's address entry in fdb when remove the bridge dev
From: Ding Tianhong @ 2013-11-18 8:26 UTC (permalink / raw)
To: Stephen Hemminger, David S. Miller, bridge, Netdev
When the following commands are executed:
brctl addbr br0
ifconfig br0 hw ether <addr>
rmmod bridge
The calltrace will occur:
[ 563.312114] device eth1 left promiscuous mode
[ 563.312188] br0: port 1(eth1) entered disabled state
[ 563.468190] kmem_cache_destroy bridge_fdb_cache: Slab cache still has objects
[ 563.468197] CPU: 6 PID: 6982 Comm: rmmod Tainted: G O 3.12.0-0.7-default+ #9
[ 563.468199] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 563.468200] 0000000000000880 ffff88010f111e98 ffffffff814d1c92 ffff88010f111eb8
[ 563.468204] ffffffff81148efd ffff88010f111eb8 0000000000000000 ffff88010f111ec8
[ 563.468206] ffffffffa062a270 ffff88010f111ed8 ffffffffa063ac76 ffff88010f111f78
[ 563.468209] Call Trace:
[ 563.468218] [<ffffffff814d1c92>] dump_stack+0x6a/0x78
[ 563.468234] [<ffffffff81148efd>] kmem_cache_destroy+0xfd/0x100
[ 563.468242] [<ffffffffa062a270>] br_fdb_fini+0x10/0x20 [bridge]
[ 563.468247] [<ffffffffa063ac76>] br_deinit+0x4e/0x50 [bridge]
[ 563.468254] [<ffffffff810c7dc9>] SyS_delete_module+0x199/0x2b0
[ 563.468259] [<ffffffff814e0922>] system_call_fastpath+0x16/0x1b
[ 570.377958] Bridge firewalling registered
------------------------- cut here ---------------------------
The reason is that if the bridge dev's address is changed, the
br_fdb_change_mac_address() will add new address in fdb, but when
the bridge was removed, the address entry in the fdb did not free,
the bridge_fdb_cache still has objects when destroy the cache, Fix
this by flushing the bridge address entry when removing the bridge.
Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
---
net/bridge/br_if.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c41d5fb..baedc32 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -172,6 +172,10 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
del_nbp(p);
}
+ spin_lock_bh(&br->hash_lock);
+ fdb_delete_by_addr(br, br->dev->dev_addr, 0);
+ spin_unlock_bh(&br->hash_lock);
+
del_timer_sync(&br->gc_timer);
br_sysfs_delbr(br->dev);
--
1.7.12
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox