* [PATCH net-next 1/4] ipv6: coding style - no assignment in if statements
From: Ian Morris @ 2014-09-02 19:16 UTC (permalink / raw)
To: netdev; +Cc: Ian Morris
In-Reply-To: <1409685364-4327-1-git-send-email-ipm@chirality.org.uk>
This patch makes no changes to the logic of the ipv6 stack however
it addresses some coding style issues by removing assignments made
in if statements.
No change in the object output is detected by the objdiff script.
Signed-off-by: Ian Morris <ipm@chirality.org.uk>
---
net/ipv6/addrconf.c | 12 ++++++++----
net/ipv6/ah6.c | 7 ++++---
net/ipv6/datagram.c | 3 ++-
net/ipv6/esp6.c | 3 ++-
net/ipv6/icmp.c | 3 ++-
net/ipv6/ip6_flowlabel.c | 6 +++++-
net/ipv6/ip6_input.c | 3 ++-
net/ipv6/ip6_output.c | 17 ++++++++++-------
net/ipv6/ip6_tunnel.c | 16 ++++++++--------
net/ipv6/ip6_vti.c | 4 ++--
net/ipv6/ndisc.c | 7 ++++---
net/ipv6/raw.c | 3 ++-
net/ipv6/reassembly.c | 3 ++-
net/ipv6/sit.c | 7 ++++---
net/ipv6/udp.c | 6 ++++--
net/ipv6/xfrm6_protocol.c | 25 ++++++++++++++++---------
16 files changed, 77 insertions(+), 48 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 267ce3c..509c53e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2524,7 +2524,8 @@ static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
if (!dev)
return -ENODEV;
- if ((idev = __in6_dev_get(dev)) == NULL)
+ idev = __in6_dev_get(dev);
+ if (idev == NULL)
return -ENXIO;
read_lock_bh(&idev->lock);
@@ -2671,7 +2672,8 @@ static void init_loopback(struct net_device *dev)
ASSERT_RTNL();
- if ((idev = ipv6_find_idev(dev)) == NULL) {
+ idev = ipv6_find_idev(dev);
+ if (idev == NULL) {
pr_debug("%s: add_dev failed\n", __func__);
return;
}
@@ -2794,7 +2796,8 @@ static void addrconf_sit_config(struct net_device *dev)
* our v4 addrs in the tunnel
*/
- if ((idev = ipv6_find_idev(dev)) == NULL) {
+ idev = ipv6_find_idev(dev);
+ if (idev == NULL) {
pr_debug("%s: add_dev failed\n", __func__);
return;
}
@@ -2818,7 +2821,8 @@ static void addrconf_gre_config(struct net_device *dev)
ASSERT_RTNL();
- if ((idev = ipv6_find_idev(dev)) == NULL) {
+ idev = ipv6_find_idev(dev);
+ if (idev == NULL) {
pr_debug("%s: add_dev failed\n", __func__);
return;
}
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index fcffd4e..dc33a77 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -354,7 +354,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
ahp = x->data;
ahash = ahp->ahash;
- if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+ err = skb_cow_data(skb, 0, &trailer);
+ if (err < 0)
goto out;
nfrags = err;
@@ -560,8 +561,8 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
if (!pskb_may_pull(skb, ah_hlen))
goto out;
-
- if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+ err = skb_cow_data(skb, 0, &trailer);
+ if (err < 0)
goto out;
nfrags = err;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 1844e87..69f3153 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -418,7 +418,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
/* Reset and regenerate socket error */
spin_lock_bh(&sk->sk_error_queue.lock);
sk->sk_err = 0;
- if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
+ skb2 = skb_peek(&sk->sk_error_queue);
+ if (skb2 != NULL) {
sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
spin_unlock_bh(&sk->sk_error_queue.lock);
sk->sk_error_report(sk);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 83fc3a3..3cee92d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -345,7 +345,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
goto out;
}
- if ((nfrags = skb_cow_data(skb, 0, &trailer)) < 0) {
+ nfrags = skb_cow_data(skb, 0, &trailer);
+ if (nfrags < 0) {
ret = -EINVAL;
goto out;
}
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 394bb82..5c79dbb 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -239,7 +239,8 @@ int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
struct icmp6hdr *icmp6h;
int err = 0;
- if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
+ skb = skb_peek(&sk->sk_write_queue);
+ if (skb == NULL)
goto out;
icmp6h = icmp6_hdr(skb);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 3dd7d4e..36da541 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -654,7 +654,11 @@ release:
goto done;
err = -ENOMEM;
- if (sfl1 == NULL || (err = mem_check(sk)) != 0)
+ if (sfl1 == NULL)
+ goto done;
+
+ err = mem_check(sk);
+ if (err != 0)
goto done;
fl1 = fl_intern(net, fl, freq.flr_label);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index a3084ab..aacdcb4 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -220,7 +220,8 @@ resubmit:
nexthdr = skb_network_header(skb)[nhoff];
raw = raw6_local_deliver(skb, nexthdr);
- if ((ipprot = rcu_dereference(inet6_protos[nexthdr])) != NULL) {
+ ipprot = rcu_dereference(inet6_protos[nexthdr]);
+ if (ipprot != NULL) {
int ret;
if (ipprot->flags & INET6_PROTO_FINAL) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index b7a3e7b..86fc687 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -754,9 +754,8 @@ slow_path:
/*
* Allocate buffer.
*/
-
- if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
- hroom + troom, GFP_ATOMIC)) == NULL) {
+ frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) + hroom + troom, GFP_ATOMIC);
+ if (frag == NULL) {
NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
IPSTATS_MIB_FRAGFAILS);
@@ -904,7 +903,8 @@ static int ip6_dst_lookup_tail(struct sock *sk,
if (*dst == NULL)
*dst = ip6_route_output(net, sk, fl6);
- if ((err = (*dst)->error))
+ err = (*dst)->error;
+ if (err)
goto out_err_release;
if (ipv6_addr_any(&fl6->saddr)) {
@@ -952,7 +952,8 @@ static int ip6_dst_lookup_tail(struct sock *sk,
memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
*dst = ip6_route_output(net, sk, &fl_gw6);
- if ((err = (*dst)->error))
+ err = (*dst)->error;
+ if (err)
goto out_err_release;
}
}
@@ -1060,7 +1061,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
* device, so create one single skb packet containing complete
* udp datagram
*/
- if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
+ skb = skb_peek_tail(&sk->sk_write_queue);
+ if (skb == NULL) {
skb = sock_alloc_send_skb(sk,
hh_len + fragheaderlen + transhdrlen + 20,
(flags & MSG_DONTWAIT), &err);
@@ -1540,7 +1542,8 @@ int ip6_push_pending_frames(struct sock *sk)
unsigned char proto = fl6->flowi6_proto;
int err = 0;
- if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
+ skb = __skb_dequeue(&sk->sk_write_queue);
+ if (skb == NULL)
goto out;
tail_skb = &(skb_shinfo(skb)->frag_list);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index e01bd03..b38cc18 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -482,8 +482,8 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
processing of the error. */
rcu_read_lock();
- if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
- &ipv6h->saddr)) == NULL)
+ t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr, &ipv6h->saddr);
+ if (t == NULL)
goto out;
if (t->parms.proto != ipproto && t->parms.proto != 0)
@@ -530,7 +530,8 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
mtu = IPV6_MIN_MTU;
t->dev->mtu = mtu;
- if ((len = sizeof(*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
+ len = sizeof(*ipv6h) + ntohs(ipv6h->payload_len);
+ if (len > mtu) {
rel_type = ICMPV6_PKT_TOOBIG;
rel_code = 0;
rel_info = mtu;
@@ -790,9 +791,8 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
int err;
rcu_read_lock();
-
- if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
- &ipv6h->daddr)) != NULL) {
+ t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr, &ipv6h->daddr);
+ if (t != NULL) {
struct pcpu_sw_netstats *tstats;
if (t->parms.proto != ipproto && t->parms.proto != 0) {
@@ -1016,8 +1016,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
(skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
struct sk_buff *new_skb;
-
- if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
+ new_skb = skb_realloc_headroom(skb, max_headroom);
+ if (!new_skb)
goto tx_err_dst_release;
if (skb->sk)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 7f52fd9..77a194f 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -287,8 +287,8 @@ static int vti6_rcv(struct sk_buff *skb)
const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
rcu_read_lock();
- if ((t = vti6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
- &ipv6h->daddr)) != NULL) {
+ t = vti6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr, &ipv6h->daddr);
+ if (t != NULL) {
if (t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) {
rcu_read_unlock();
goto discard;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 4cb45c1..d0232b2 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -162,7 +162,8 @@ static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
memcpy(opt+2, data, data_len);
data_len += 2;
opt += data_len;
- if ((space -= data_len) > 0)
+ space -= data_len;
+ if (space > 0)
memset(opt, 0, space);
}
@@ -656,8 +657,8 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
saddr = &ipv6_hdr(skb)->saddr;
-
- if ((probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES)) < 0) {
+ probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
+ if (probes < 0) {
if (!(neigh->nud_state & NUD_VALID)) {
ND_PRINTK(1, dbg,
"%s: trying to ucast probe in NUD_INVALID: %pI6\n",
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 896af88..af3661c 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -548,7 +548,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
if (!rp->checksum)
goto send;
- if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
+ skb = skb_peek(&sk->sk_write_queue);
+ if (skb == NULL)
goto out;
offset = rp->offset;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 1a157ca..9bd8a04 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -429,7 +429,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
struct sk_buff *clone;
int i, plen = 0;
- if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL)
+ clone = alloc_skb(0, GFP_ATOMIC);
+ if (clone == NULL)
goto out_oom;
clone->next = head->next;
head->next = clone;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 86e3fa8..e2b199f 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1229,7 +1229,8 @@ ipip6_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
goto done;
err = -ENOENT;
- if ((t = ipip6_tunnel_locate(net, &p, 0)) == NULL)
+ t = ipip6_tunnel_locate(net, &p, 0);
+ if (t == NULL)
goto done;
err = -EPERM;
if (t == netdev_priv(sitn->fb_tunnel_dev))
@@ -1748,8 +1749,8 @@ static int __net_init sit_init_net(struct net *net)
goto err_dev_free;
ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
-
- if ((err = register_netdev(sitn->fb_tunnel_dev)))
+ err = register_netdev(sitn->fb_tunnel_dev);
+ if (err)
goto err_reg_dev;
t = netdev_priv(sitn->fb_tunnel_dev);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 12fcce8f..e06d460 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -357,7 +357,8 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
struct sock *sk;
const struct ipv6hdr *iph = ipv6_hdr(skb);
- if (unlikely(sk = skb_steal_sock(skb)))
+ sk = skb_steal_sock(skb);
+ if (unlikely(sk))
return sk;
return __udp6_lib_lookup(dev_net(skb_dst(skb)->dev), &iph->saddr, sport,
&iph->daddr, dport, inet6_iif(skb),
@@ -1021,7 +1022,8 @@ static int udp_v6_push_pending_frames(struct sock *sk)
fl6 = &inet->cork.fl.u.ip6;
/* Grab the skbuff where UDP header space exists. */
- if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
+ skb = skb_peek(&sk->sk_write_queue);
+ if (skb == NULL)
goto out;
/*
diff --git a/net/ipv6/xfrm6_protocol.c b/net/ipv6/xfrm6_protocol.c
index 54d13f8..f200927 100644
--- a/net/ipv6/xfrm6_protocol.c
+++ b/net/ipv6/xfrm6_protocol.c
@@ -55,9 +55,11 @@ int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err)
if (!head)
return 0;
- for_each_protocol_rcu(*proto_handlers(protocol), handler)
- if ((ret = handler->cb_handler(skb, err)) <= 0)
+ for_each_protocol_rcu(*proto_handlers(protocol), handler) {
+ ret = handler->cb_handler(skb, err);
+ if (ret <= 0)
return ret;
+ }
return 0;
}
@@ -70,9 +72,11 @@ static int xfrm6_esp_rcv(struct sk_buff *skb)
XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
- for_each_protocol_rcu(esp6_handlers, handler)
- if ((ret = handler->handler(skb)) != -EINVAL)
+ for_each_protocol_rcu(esp6_handlers, handler) {
+ ret = handler->handler(skb);
+ if (ret != -EINVAL)
return ret;
+ }
icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
@@ -97,9 +101,11 @@ static int xfrm6_ah_rcv(struct sk_buff *skb)
XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
- for_each_protocol_rcu(ah6_handlers, handler)
- if ((ret = handler->handler(skb)) != -EINVAL)
+ for_each_protocol_rcu(ah6_handlers, handler) {
+ ret = handler->handler(skb);
+ if (ret != -EINVAL)
return ret;
+ }
icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
@@ -124,10 +130,11 @@ static int xfrm6_ipcomp_rcv(struct sk_buff *skb)
XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
- for_each_protocol_rcu(ipcomp6_handlers, handler)
- if ((ret = handler->handler(skb)) != -EINVAL)
+ for_each_protocol_rcu(ipcomp6_handlers, handler) {
+ ret = handler->handler(skb);
+ if (ret != -EINVAL)
return ret;
-
+ }
icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
kfree_skb(skb);
--
1.7.9.5
^ permalink raw reply related
* [PATCH net-next 2/4] ipv6: coding style - min to min_t conversion
From: Ian Morris @ 2014-09-02 19:16 UTC (permalink / raw)
To: netdev; +Cc: Ian Morris
In-Reply-To: <1409685364-4327-1-git-send-email-ipm@chirality.org.uk>
This patch changes a min to min_t as per checkpatch recomendation.
No change in the object output is detected by the objdiff script.
Signed-off-by: Ian Morris <ipm@chirality.org.uk>
---
net/ipv6/addrconf.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 509c53e..23d8493 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2320,8 +2320,11 @@ ok:
else
stored_lft = 0;
if (!update_lft && !create && stored_lft) {
- const u32 minimum_lft = min(
- stored_lft, (u32)MIN_VALID_LIFETIME);
+ const u32 minimum_lft = min_t(
+ u32,
+ stored_lft,
+ MIN_VALID_LIFETIME);
+
valid_lft = max(valid_lft, minimum_lft);
/* RFC4862 Section 5.5.3e:
--
1.7.9.5
^ permalink raw reply related
* [PATCH net-next 3/4] ipv6: coding style - convert printk
From: Ian Morris @ 2014-09-02 19:16 UTC (permalink / raw)
To: netdev; +Cc: Ian Morris
In-Reply-To: <1409685364-4327-1-git-send-email-ipm@chirality.org.uk>
No change in the object output is detected by the objdiff script.
Signed-off-by: Ian Morris <ipm@chirality.org.uk>
---
net/ipv6/exthdrs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 8af3eb5..2f2945d 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -198,7 +198,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);
if (!ip6 || (ip6->version != 6)) {
- printk(KERN_ERR "IPv6 header not found\n");
+ pr_err("IPv6 header not found\n");
return -EBADMSG;
}
start = *offset + sizeof(struct ipv6hdr);
--
1.7.9.5
^ permalink raw reply related
* [PATCH net-next 4/4] ipv6: coding style - cleanse bracing
From: Ian Morris @ 2014-09-02 19:16 UTC (permalink / raw)
To: netdev; +Cc: Ian Morris
In-Reply-To: <1409685364-4327-1-git-send-email-ipm@chirality.org.uk>
Tidy up braces in a few places (mainly if statements):
* remove unnecessary braces
* add braces for single line statements where part of an "else" where the other branch has braces
No change in the object output is detected by the objdiff script.
Signed-off-by: Ian Morris <ipm@chirality.org.uk>
---
net/ipv6/addrconf.c | 11 +++++------
net/ipv6/addrconf_core.c | 3 +--
net/ipv6/exthdrs_core.c | 4 ++--
net/ipv6/ip6_fib.c | 4 ++--
net/ipv6/ip6_flowlabel.c | 3 +--
net/ipv6/ip6_gre.c | 4 ++--
net/ipv6/ip6_input.c | 13 +++++--------
net/ipv6/ip6_output.c | 15 +++++++--------
net/ipv6/ip6_tunnel.c | 6 +++---
net/ipv6/ip6mr.c | 13 +++++++------
net/ipv6/ipv6_sockglue.c | 7 ++++---
net/ipv6/mcast.c | 48 +++++++++++++++++++++++++++-------------------
net/ipv6/ndisc.c | 18 ++++++-----------
net/ipv6/ping.c | 8 ++++----
net/ipv6/route.c | 25 +++++++++++-------------
net/ipv6/tcp_ipv6.c | 10 ++++++----
net/ipv6/udp.c | 20 +++++++++----------
net/ipv6/xfrm6_output.c | 4 ++--
net/ipv6/xfrm6_tunnel.c | 3 ++-
19 files changed, 108 insertions(+), 111 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 23d8493..f31a204 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -895,9 +895,9 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
out2:
rcu_read_unlock_bh();
- if (likely(err == 0))
+ if (likely(err == 0)) {
inet6addr_notifier_call_chain(NETDEV_UP, ifa);
- else {
+ } else {
kfree(ifa);
ifa = ERR_PTR(err);
}
@@ -979,9 +979,9 @@ cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_r
ifp->idev->dev,
0, RTF_GATEWAY | RTF_DEFAULT);
if (rt) {
- if (del_rt)
+ if (del_rt) {
ip6_del_rt(rt);
- else {
+ } else {
if (!(rt->rt6i_flags & RTF_EXPIRES))
rt6_set_expires(rt, expires);
ip6_rt_put(rt);
@@ -1037,10 +1037,9 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);
- if (action != CLEANUP_PREFIX_RT_NOP) {
+ if (action != CLEANUP_PREFIX_RT_NOP)
cleanup_prefix_route(ifp, expires,
action == CLEANUP_PREFIX_RT_DEL);
- }
/* clean up prefsrc entries */
rt6_remove_prefsrc(ifp);
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index e696045..cfa6739 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -40,12 +40,11 @@ int __ipv6_addr_type(const struct in6_addr *addr)
return (IPV6_ADDR_UNICAST |
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));
- if ((st & htonl(0xFF000000)) == htonl(0xFF000000)) {
+ if ((st & htonl(0xFF000000)) == htonl(0xFF000000))
/* multicast */
/* addr-select 3.1 */
return (IPV6_ADDR_MULTICAST |
ipv6_addr_scope2type(IPV6_ADDR_MC_SCOPE(addr)));
- }
if ((st & htonl(0xFFC00000)) == htonl(0xFE800000))
return (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST |
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 2f2945d..4ffc04f 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -264,9 +264,9 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
if (flags && (*flags & IP6_FH_F_AUTH) && (target < 0))
break;
hdrlen = (hp->hdrlen + 2) << 2;
- } else
+ } else {
hdrlen = ipv6_optlen(hp);
-
+ }
if (!found) {
nexthdr = hp->nexthdr;
len -= hdrlen;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 76b7f5e..17aceb6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -334,9 +334,9 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
w->state = FWS_INIT;
w->node = w->root;
w->skip = w->count;
- } else
+ } else {
w->skip = 0;
-
+ }
read_lock_bh(&table->tb6_lock);
res = fib6_walk_continue(w);
read_unlock_bh(&table->tb6_lock);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 36da541..c99a031 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -162,9 +162,8 @@ static void ip6_fl_gc(unsigned long dummy)
}
if (!sched && atomic_read(&fl_size))
sched = now + FL_MAX_LINGER;
- if (sched) {
+ if (sched)
mod_timer(&ip6_fl_gc_timer, sched);
- }
spin_unlock(&ip6_fl_lock);
}
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 5f19dfb..7f9283f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1124,8 +1124,9 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev,
ip6gre_tnl_parm_to_user(&p, &t->parms);
if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
err = -EFAULT;
- } else
+ } else {
err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+ }
break;
case SIOCDELTUNNEL:
@@ -1339,7 +1340,6 @@ static int __net_init ip6gre_init_net(struct net *net)
*/
ign->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
-
ip6gre_fb_tunnel_init(ign->fb_tunnel_dev);
ign->fb_tunnel_dev->rtnl_link_ops = &ip6gre_link_ops;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index aacdcb4..ba3a7f8 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -338,25 +338,22 @@ int ip6_mc_input(struct sk_buff *skb)
/* unknown RA - process it normally */
}
- if (deliver)
+ if (deliver) {
skb2 = skb_clone(skb, GFP_ATOMIC);
- else {
+ } else {
skb2 = skb;
skb = NULL;
}
- if (skb2) {
+ if (skb2)
ip6_mr_input(skb2);
- }
}
out:
#endif
if (likely(deliver))
ip6_input(skb);
- else {
- /* discard */
- kfree_skb(skb);
- }
+ else
+ kfree_skb(skb); /* discard */
return 0;
}
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 86fc687..5e520f2 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -275,9 +275,9 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
if (offset < 0)
return 0;
- } else
+ } else {
offset = sizeof(struct ipv6hdr);
-
+ }
if (nexthdr == IPPROTO_ICMPV6) {
struct icmp6hdr *icmp6;
@@ -388,7 +388,7 @@ int ip6_forward(struct sk_buff *skb)
/*
* We DO NOT make any processing on
* RA packets, pushing them to user level AS IS
- * without ane WARRANTY that application will be able
+ * without any WARRANTY that application will be able
* to interpret them. The reason is that we
* cannot make anything clever here.
*
@@ -741,16 +741,15 @@ slow_path:
/*
* Keep copying data until we run out.
*/
- while (left > 0) {
+ while (left > 0) {
len = left;
/* IF: it doesn't fit, use 'mtu' - the data space left */
if (len > mtu)
len = mtu;
/* IF: we are not sending up to and including the packet end
then align the next start on an eight byte boundary */
- if (len < left) {
+ if (len < left)
len &= ~7;
- }
/*
* Allocate buffer.
*/
@@ -795,9 +794,9 @@ slow_path:
if (!frag_id) {
ipv6_select_ident(fh, rt);
frag_id = fh->identification;
- } else
+ } else {
fh->identification = frag_id;
-
+ }
/*
* Copy a block of the IP datagram.
*/
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index b38cc18..488f0dc 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1362,9 +1362,8 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
memset(&p, 0, sizeof(p));
}
ip6_tnl_parm_to_user(&p, &t->parms);
- if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p))) {
+ if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
err = -EFAULT;
- }
break;
case SIOCADDTUNNEL:
case SIOCCHGTUNNEL:
@@ -1640,8 +1639,9 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
if (t) {
if (t->dev != dev)
return -EEXIST;
- } else
+ } else {
t = netdev_priv(dev);
+ }
return ip6_tnl_update(t, &p);
}
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0171f08..ea054d5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -853,8 +853,9 @@ static void ip6mr_destroy_unres(struct mr6_table *mrt, struct mfc6_cache *c)
skb_trim(skb, nlh->nlmsg_len);
((struct nlmsgerr *)nlmsg_data(nlh))->error = -ETIMEDOUT;
rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
- } else
+ } else {
kfree_skb(skb);
+ }
}
ip6mr_cache_free(c);
@@ -1116,8 +1117,9 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
((struct nlmsgerr *)nlmsg_data(nlh))->error = -EMSGSIZE;
}
rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
- } else
+ } else {
ip6_mr_forward(net, mrt, skb, c);
+ }
}
}
@@ -1591,9 +1593,9 @@ static int ip6mr_sk_init(struct mr6_table *mrt, struct sock *sk)
inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING,
NETCONFA_IFINDEX_ALL,
net->ipv6.devconf_all);
- }
- else
+ } else {
err = -EADDRINUSE;
+ }
write_unlock_bh(&mrt_lock);
rtnl_unlock();
@@ -2406,8 +2408,7 @@ static int mr6_msgsize(bool unresolved, int maxvif)
+ nla_total_size(0) /* RTA_MULTIPATH */
+ maxvif * NLA_ALIGN(sizeof(struct rtnexthop))
/* RTA_MFC_STATS */
- + nla_total_size(sizeof(struct rta_mfc_stats))
- ;
+ + nla_total_size(sizeof(struct rta_mfc_stats));
return len;
}
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index e1a9583..8811f84 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -129,14 +129,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
int val, valbool;
int retv = -ENOPROTOOPT;
- if (optval == NULL)
+ if (optval == NULL) {
val = 0;
- else {
+ } else {
if (optlen >= sizeof(int)) {
if (get_user(val, (int __user *) optval))
return -EFAULT;
- } else
+ } else {
val = 0;
+ }
}
valbool = (val != 0);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 7088179..2eb811e 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -180,9 +180,9 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
dev = rt->dst.dev;
ip6_rt_put(rt);
}
- } else
+ } else {
dev = dev_get_by_index_rcu(net, ifindex);
-
+ }
if (dev == NULL) {
rcu_read_unlock();
sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
@@ -277,9 +277,9 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
dev = rt->dst.dev;
ip6_rt_put(rt);
}
- } else
+ } else {
dev = dev_get_by_index_rcu(net, ifindex);
-
+ }
if (!dev)
return NULL;
idev = __in6_dev_get(dev);
@@ -318,8 +318,9 @@ void ipv6_sock_mc_close(struct sock *sk)
(void) ip6_mc_leave_src(sk, mc_lst, idev);
if (idev)
__ipv6_dev_mc_dec(idev, &mc_lst->addr);
- } else
+ } else {
(void) ip6_mc_leave_src(sk, mc_lst, NULL);
+ }
rcu_read_unlock();
atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
@@ -537,8 +538,9 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
(void) ip6_mc_del_src(idev, group, pmc->sfmode,
psl->sl_count, psl->sl_addr, 0);
sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
- } else
+ } else {
(void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
+ }
pmc->sflist = newpsl;
pmc->sfmode = gsf->gf_fmode;
write_unlock(&pmc->sflock);
@@ -1359,9 +1361,9 @@ int igmp6_event_query(struct sk_buff *skb)
mlh2 = (struct mld2_query *)skb_transport_header(skb);
mark = 1;
}
- } else
+ } else {
return -EINVAL;
-
+ }
read_lock_bh(&idev->lock);
if (group_type == IPV6_ADDR_ANY) {
for (ma = idev->mc_list; ma; ma = ma->next) {
@@ -1832,8 +1834,9 @@ static void mld_clear_zeros(struct ip6_sf_list **ppsf)
else
*ppsf = psf->sf_next;
kfree(psf);
- } else
+ } else {
psf_prev = psf;
+ }
}
}
@@ -1875,8 +1878,9 @@ static void mld_send_cr(struct inet6_dev *idev)
idev->mc_tomb = pmc_next;
in6_dev_put(pmc->idev);
kfree(pmc);
- } else
+ } else {
pmc_prev = pmc;
+ }
}
spin_unlock(&idev->mc_lock);
@@ -1960,9 +1964,9 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
* when a valid link-local address is not available.
*/
saddr = &in6addr_any;
- } else
+ } else {
saddr = &addr_buf;
-
+ }
ip6_mc_hdr(sk, skb, dev, saddr, snd_addr, NEXTHDR_HOP, payload_len);
memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
@@ -1996,9 +2000,9 @@ out:
ICMP6MSGOUT_INC_STATS(net, idev, type);
ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len);
- } else
+ } else {
IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
-
+ }
rcu_read_unlock();
return;
@@ -2087,8 +2091,9 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
psf->sf_next = pmc->mca_tomb;
pmc->mca_tomb = psf;
rv = 1;
- } else
+ } else {
kfree(psf);
+ }
}
return rv;
}
@@ -2143,8 +2148,9 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
psf->sf_crcount = 0;
mld_ifc_event(pmc->idev);
- } else if (sf_setstate(pmc) || changerec)
+ } else if (sf_setstate(pmc) || changerec) {
mld_ifc_event(pmc->idev);
+ }
spin_unlock_bh(&pmc->mca_lock);
read_unlock_bh(&idev->lock);
return err;
@@ -2170,9 +2176,9 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
return -ENOBUFS;
psf->sf_addr = *psfsrc;
- if (psf_prev) {
+ if (psf_prev)
psf_prev->sf_next = psf;
- } else
+ else
pmc->mca_sources = psf;
}
psf->sf_count[sfmode]++;
@@ -2189,8 +2195,9 @@ static void sf_markstate(struct ifmcaddr6 *pmc)
psf->sf_oldin = mca_xcount ==
psf->sf_count[MCAST_EXCLUDE] &&
!psf->sf_count[MCAST_INCLUDE];
- } else
+ } else {
psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
+ }
}
static int sf_setstate(struct ifmcaddr6 *pmc)
@@ -2311,8 +2318,9 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
psf->sf_crcount = 0;
mld_ifc_event(idev);
- } else if (sf_setstate(pmc))
+ } else if (sf_setstate(pmc)) {
mld_ifc_event(idev);
+ }
spin_unlock_bh(&pmc->mca_lock);
read_unlock_bh(&idev->lock);
return err;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d0232b2..a38d730 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -303,9 +303,8 @@ static int ndisc_constructor(struct neighbour *neigh)
bool is_multicast = ipv6_addr_is_multicast(addr);
in6_dev = in6_dev_get(dev);
- if (in6_dev == NULL) {
+ if (in6_dev == NULL)
return -EINVAL;
- }
parms = in6_dev->nd_parms;
__neigh_parms_put(neigh->parms);
@@ -604,9 +603,8 @@ void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
dev, 1);
if (ifp) {
- if (ifp->flags & IFA_F_OPTIMISTIC) {
+ if (ifp->flags & IFA_F_OPTIMISTIC)
send_sllao = 0;
- }
in6_ifa_put(ifp);
} else {
send_sllao = 0;
@@ -805,8 +803,9 @@ static void ndisc_recv_ns(struct sk_buff *skb)
pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
goto out;
}
- } else
+ } else {
goto out;
+ }
}
if (is_router < 0)
@@ -865,18 +864,15 @@ static void ndisc_recv_na(struct sk_buff *skb)
ND_PRINTK(2, warn, "NA: packet too short\n");
return;
}
-
if (ipv6_addr_is_multicast(&msg->target)) {
ND_PRINTK(2, warn, "NA: target address is multicast\n");
return;
}
-
if (ipv6_addr_is_multicast(daddr) &&
msg->icmph.icmp6_solicited) {
ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
return;
}
-
if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
ND_PRINTK(2, warn, "NS: invalid ND option\n");
return;
@@ -1026,9 +1022,8 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
}
nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
- if (nlh == NULL) {
+ if (nlh == NULL)
goto nla_put_failure;
- }
ndmsg = nlmsg_data(nlh);
ndmsg->nduseropt_family = AF_INET6;
@@ -1376,9 +1371,8 @@ skip_routeinfo:
}
}
- if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
+ if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh)
ND_PRINTK(2, warn, "RA: invalid RA options\n");
- }
out:
ip6_rt_put(rt);
if (neigh)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 5b7a1ed..b1274f4 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -103,13 +103,13 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
if (msg->msg_name) {
DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
- u->sin6_family != AF_INET6) {
+ u->sin6_family != AF_INET6)
return -EINVAL;
- }
+
if (sk->sk_bound_dev_if &&
- sk->sk_bound_dev_if != u->sin6_scope_id) {
+ sk->sk_bound_dev_if != u->sin6_scope_id)
return -EINVAL;
- }
+
daddr = &(u->sin6_addr);
iif = u->sin6_scope_id;
} else {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f74b041..0b924e3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -708,9 +708,8 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
unsigned long lifetime;
struct rt6_info *rt;
- if (len < sizeof(struct route_info)) {
+ if (len < sizeof(struct route_info))
return -EINVAL;
- }
/* Sanity check for prefix_len and length */
if (rinfo->length > 3) {
@@ -718,13 +717,11 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
} else if (rinfo->prefix_len > 128) {
return -EINVAL;
} else if (rinfo->prefix_len > 64) {
- if (rinfo->length < 2) {
+ if (rinfo->length < 2)
return -EINVAL;
- }
} else if (rinfo->prefix_len > 0) {
- if (rinfo->length < 1) {
+ if (rinfo->length < 1)
return -EINVAL;
- }
}
pref = rinfo->route_pref;
@@ -733,9 +730,9 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
- if (rinfo->length == 3)
+ if (rinfo->length == 3) {
prefix = (struct in6_addr *)rinfo->prefix;
- else {
+ } else {
/* this function is safe */
ipv6_addr_prefix(&prefix_buf,
(struct in6_addr *)rinfo->prefix,
@@ -2578,13 +2575,13 @@ static int rt6_fill_node(struct net *net,
rtm->rtm_type = RTN_UNREACHABLE;
break;
}
- }
- else if (rt->rt6i_flags & RTF_LOCAL)
+ } else if (rt->rt6i_flags & RTF_LOCAL) {
rtm->rtm_type = RTN_LOCAL;
- else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
+ } else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK)) {
rtm->rtm_type = RTN_LOCAL;
- else
+ } else {
rtm->rtm_type = RTN_UNICAST;
+ }
rtm->rtm_flags = 0;
rtm->rtm_scope = RT_SCOPE_UNIVERSE;
rtm->rtm_protocol = rt->rt6i_protocol;
@@ -2682,9 +2679,9 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
if (nlmsg_len(arg->cb->nlh) >= sizeof(struct rtmsg)) {
struct rtmsg *rtm = nlmsg_data(arg->cb->nlh);
prefix = (rtm->rtm_flags & RTM_F_PREFIX) != 0;
- } else
+ } else {
prefix = 0;
-
+ }
return rt6_fill_node(arg->net,
arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
NETLINK_CB(arg->cb->skb).portid, arg->cb->nlh->nlmsg_seq,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 29964c3..2790300 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -454,16 +454,18 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
sk->sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */
tcp_done(sk);
- } else
+ } else {
sk->sk_err_soft = err;
+ }
goto out;
}
if (!sock_owned_by_user(sk) && np->recverr) {
sk->sk_err = err;
sk->sk_error_report(sk);
- } else
+ } else {
sk->sk_err_soft = err;
+ }
out:
bh_unlock_sock(sk);
@@ -1323,9 +1325,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
__kfree_skb(opt_skb);
return 0;
}
- } else
+ } else {
sock_rps_save_rxhash(sk, skb);
-
+ }
if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
goto reset;
if (opt_skb)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e06d460..d59c723 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -424,10 +424,10 @@ try_again:
goto csum_copy_err;
}
- if (skb_csum_unnecessary(skb))
+ if (skb_csum_unnecessary(skb)) {
err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov, copied);
- else {
+ } else {
err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
if (err == -EINVAL)
goto csum_copy_err;
@@ -488,7 +488,6 @@ try_again:
if (np->rxopt.all)
ip6_datagram_recv_specific_ctl(sk, msg, skb);
}
-
err = copied;
if (flags & MSG_TRUNC)
err = ulen;
@@ -819,11 +818,10 @@ start_lookup:
goto start_lookup;
}
- if (count) {
+ if (count)
flush_stack(stack, count, skb, count - 1);
- } else {
+ else
kfree_skb(skb);
- }
return 0;
}
@@ -1061,9 +1059,10 @@ send:
UDP_MIB_SNDBUFERRORS, is_udplite);
err = 0;
}
- } else
+ } else {
UDP6_INC_STATS_USER(sock_net(sk),
UDP_MIB_OUTDATAGRAMS, is_udplite);
+ }
out:
up->len = 0;
up->pending = 0;
@@ -1119,9 +1118,9 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
if (sk->sk_state != TCP_ESTABLISHED)
return -EDESTADDRREQ;
daddr = &sk->sk_v6_daddr;
- } else
+ } else {
daddr = NULL;
-
+ }
if (daddr) {
if (ipv6_addr_v4mapped(daddr)) {
struct sockaddr_in sin;
@@ -1453,7 +1452,8 @@ int __net_init udp6_proc_init(struct net *net)
return udp_proc_register(net, &udp6_seq_afinfo);
}
-void udp6_proc_exit(struct net *net) {
+void udp6_proc_exit(struct net *net)
+{
udp_proc_unregister(net, &udp6_seq_afinfo);
}
#endif /* CONFIG_PROC_FS */
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index ca3f29b..f9f745d 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -159,9 +159,9 @@ static int __xfrm6_output(struct sk_buff *skb)
if (x->props.mode == XFRM_MODE_TUNNEL &&
((skb->len > mtu && !skb_is_gso(skb)) ||
- dst_allfrag(skb_dst(skb)))) {
+ dst_allfrag(skb_dst(skb))))
return ip6_fragment(skb, x->outer_mode->afinfo->output_finish);
- }
+
return x->outer_mode->afinfo->output_finish(skb);
}
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 5743044..2965098 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -180,8 +180,9 @@ __be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
if (x6spi) {
atomic_inc(&x6spi->refcnt);
spi = x6spi->spi;
- } else
+ } else {
spi = __xfrm6_tunnel_alloc_spi(net, saddr);
+ }
spin_unlock_bh(&xfrm6_tunnel_spi_lock);
return htonl(spi);
--
1.7.9.5
^ permalink raw reply related
* Re: RTNL: assertion failed at net/ipv6/addrconf.c (1699)
From: Cong Wang @ 2014-09-02 19:18 UTC (permalink / raw)
To: Hannes Frederic Sowa
Cc: Sabrina Dubroca, Tommi Rantala, David S. Miller, Alexey Kuznetsov,
James Morris, Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML,
trinity, Dave Jones
In-Reply-To: <1409684570.15984.6.camel@localhost>
On Tue, Sep 2, 2014 at 12:02 PM, Hannes Frederic Sowa
<hannes@stressinduktion.org> wrote:
>
> If fixes tag is well researched, it won't point to the addition of
> ASSERT_RTNL() but your patch would help to discover a bug somewhere else
> in the stack.
>
> I think for this patch a fixes-tag is hard to find because it is hard to
> find because it dates back to the beginning of the git history IMHO.
>
As I replied to Eric, this warning is probably caused by
the following commit:
commit c15b1ccadb323ea50023e8f1cca2954129a62b51
Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Thu Mar 27 18:28:07 2014 +0100
ipv6: move DAD and addrconf_verify processing to workqueue
HOWEVER, you can definitely argue that the code without your
ASSERT_RTNL() was already broken, it's a little hard to tell without
digging more, that might date back to the beginning of git as you said.
For safety, I think we can simply assume it's that commit to be fixed
so that we don't fix older kernels until someone really reports a bug.
^ permalink raw reply
* Re: Order of interfaces in output of ip link
From: Cong Wang @ 2014-09-02 19:30 UTC (permalink / raw)
To: Ovidiu Mara; +Cc: netdev
In-Reply-To: <19313218.dxlnVqzEMb@hp>
On Tue, Sep 2, 2014 at 7:27 AM, Ovidiu Mara <ovidiu.mara@epfl.ch> wrote:
> eth0 and eth1 are two ports on the same network card, so I would expect them to be shown together, as they are numbered. According to the documentation I found here ( http://www.policyrouting.org/iproute2.doc.html#ss9.1.1 ): "The number followed by a colon is the interface index or ifindex. This number uniquely identifies the interface. If you look at the output from cat /proc/net/dev you will see that the network devices are listed in the same order as the numbering you see here."
>
You can't rely on the output order to tell if they are the ports
on the same card, you need to dig some other information
for example sysfs.
^ permalink raw reply
* Re: [PATCH net-next v1 0/3] amd-xgbe: AMD XGBE driver updates 2014-08-29
From: Tom Lendacky @ 2014-09-02 19:55 UTC (permalink / raw)
To: David Miller; +Cc: netdev
In-Reply-To: <20140901.203152.216310411574954349.davem@davemloft.net>
On 09/01/2014 10:31 PM, David Miller wrote:
> From: Tom Lendacky <thomas.lendacky@amd.com>
> Date: Fri, 29 Aug 2014 10:21:48 -0500
>
>> The amd-xgbe-phy phylib driver support is integral to the amd-xgbe
>> driver and isn't meant to be used by other devices. For this reason
>> it is being removed from the driver/net/phy directory and integrated
>> into the amd-xgbe driver.
>
> I see no real reason to do this.
>
> Keeping it in the phylib layer forces you to deal with the abstractions
> and therefore keeps you from bypassing the phylib API and performing
> layer violations.
>
> Please just keep the PHY driver where it is and add your new features
> there.
Ok, understood. I'll drop this patch series. Any future changes or
enhancements will apply against the established file locations.
Thanks,
Tom
>
> Thanks.
>
^ permalink raw reply
* Re: [PATCH net-next 0/4] rtnl: send notification in do_setlink()
From: David Miller @ 2014-09-02 19:58 UTC (permalink / raw)
To: nicolas.dichtel; +Cc: netdev
In-Reply-To: <1409580449-4562-1-git-send-email-nicolas.dichtel@6wind.com>
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Mon, 1 Sep 2014 16:07:25 +0200
> This serie ensures to call the notifier chain and to send a netlink message when
> a change is done by do_setlink().
>
> The three first patches mainly prepare the last one, which do this change.
This looks fine, series applied, thanks.
^ permalink raw reply
* Re: [PATCH net v2] tg3: prevent ifup/ifdown during PCI error recovery
From: David Miller @ 2014-09-02 20:02 UTC (permalink / raw)
To: ivecera; +Cc: netdev, prashant, mchan
In-Reply-To: <1409574117-19435-1-git-send-email-ivecera@redhat.com>
From: Ivan Vecera <ivecera@redhat.com>
Date: Mon, 1 Sep 2014 14:21:57 +0200
> The patch fixes race conditions between PCI error recovery callbacks and
> potential ifup/ifdown.
>
> First, if ifup (tg3_open) is called between tg3_io_error_detected() and
> tg3_io_resume() then tp->timer is armed twice before expiry. Once during
> tg3_open() and again during tg3_io_resume(). This results in BUG
> at kernel/time/timer.c:945.
>
> Second, if ifdown (tg3_close) is called between tg3_io_error_detected()
> and tg3_io_resume() then tg3_napi_disable() is called twice without
> a tg3_napi_enable between. Once during tg3_io_error_detected() and again
> during tg3_close(). The tg3_io_resume() then hangs on rtnl_lock().
>
> v2: Added logging messages per Prashant's request
>
> Cc: Prashant Sreedharan <prashant@broadcom.com>
> Cc: Michael Chan <mchan@broadcom.com>
>
> Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Applied, thanks.
^ permalink raw reply
* Re: [PATCH] VMXNET3: Check for map error in vmxnet3_set_mc
From: Sergei Shtylyov @ 2014-09-02 20:02 UTC (permalink / raw)
To: Andy King, netdev, linux-kernel, virtualization
Cc: pv-drivers, penguin-kernel, davem
In-Reply-To: <1409675408-8440-1-git-send-email-acking@vmware.com>
Hello.
On 09/02/2014 08:30 PM, Andy King wrote:
> We should check if the map of the table actually succeeds, and also free
> resources accordingly. This fixes the kernel panic reported by Tetsuo
> Handa.
There's "Reported-by:" line for that.
> Version bumped to 1.2.1.0
> Acked-by: Shelley Gong <shelleygong@vmware.com>
> Acked-by: Bhavesh Davda <bhavesh@vmware.com>
> Signed-off-by: Andy King <acking@vmware.com>
> ---
> drivers/net/vmxnet3/vmxnet3_drv.c | 14 ++++++++------
> drivers/net/vmxnet3/vmxnet3_int.h | 4 ++--
> 2 files changed, 10 insertions(+), 8 deletions(-)
> diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
> index d6e90c7..f450010 100644
> --- a/drivers/net/vmxnet3/vmxnet3_drv.c
> +++ b/drivers/net/vmxnet3/vmxnet3_drv.c
[...]
> @@ -2091,11 +2093,11 @@ vmxnet3_set_mc(struct net_device *netdev)
> VMXNET3_CMD_UPDATE_MAC_FILTERS);
> spin_unlock_irqrestore(&adapter->cmd_lock, flags);
>
> - if (new_table) {
> + if (new_table_pa)
> dma_unmap_single(&adapter->pdev->dev, new_table_pa,
> rxConf->mfTableLen, PCI_DMA_TODEVICE);
> + if (new_table)
> kfree(new_table);
The above *if* is not needed -- kfree() already checks for NULL.
[...]
WBR, Sergei
^ permalink raw reply
* (unknown),
From: Andy King @ 2014-09-02 20:13 UTC (permalink / raw)
To: netdev, linux-kernel, virtualization
Cc: pv-drivers, penguin-kernel, davem, sergei.shtylyov
This version addresses Sergei's comments.
o Fixed description and added Reported-by
o Removed NULL check for kfree()
^ permalink raw reply
* [PATCH] VMXNET3: Check for map error in vmxnet3_set_mc
From: Andy King @ 2014-09-02 20:13 UTC (permalink / raw)
To: netdev, linux-kernel, virtualization
Cc: pv-drivers, penguin-kernel, Andy King, davem, sergei.shtylyov
In-Reply-To: <1409688824-32619-1-git-send-email-acking@vmware.com>
We should check if the map of the table actually succeeds, and also free
resources accordingly.
Version bumped to 1.2.1.0
Acked-by: Shelley Gong <shelleygong@vmware.com>
Acked-by: Bhavesh Davda <bhavesh@vmware.com>
Signed-off-by: Andy King <acking@vmware.com>
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
drivers/net/vmxnet3/vmxnet3_drv.c | 15 ++++++++-------
drivers/net/vmxnet3/vmxnet3_int.h | 4 ++--
2 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index d6e90c7..6dfcbf5 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2056,7 +2056,6 @@ vmxnet3_set_mc(struct net_device *netdev)
if (!netdev_mc_empty(netdev)) {
new_table = vmxnet3_copy_mc(netdev);
if (new_table) {
- new_mode |= VMXNET3_RXM_MCAST;
rxConf->mfTableLen = cpu_to_le16(
netdev_mc_count(netdev) * ETH_ALEN);
new_table_pa = dma_map_single(
@@ -2064,15 +2063,18 @@ vmxnet3_set_mc(struct net_device *netdev)
new_table,
rxConf->mfTableLen,
PCI_DMA_TODEVICE);
+ }
+
+ if (new_table_pa) {
+ new_mode |= VMXNET3_RXM_MCAST;
rxConf->mfTablePA = cpu_to_le64(new_table_pa);
} else {
- netdev_info(netdev, "failed to copy mcast list"
- ", setting ALL_MULTI\n");
+ netdev_info(netdev,
+ "failed to copy mcast list, setting ALL_MULTI\n");
new_mode |= VMXNET3_RXM_ALL_MULTI;
}
}
-
if (!(new_mode & VMXNET3_RXM_MCAST)) {
rxConf->mfTableLen = 0;
rxConf->mfTablePA = 0;
@@ -2091,11 +2093,10 @@ vmxnet3_set_mc(struct net_device *netdev)
VMXNET3_CMD_UPDATE_MAC_FILTERS);
spin_unlock_irqrestore(&adapter->cmd_lock, flags);
- if (new_table) {
+ if (new_table_pa)
dma_unmap_single(&adapter->pdev->dev, new_table_pa,
rxConf->mfTableLen, PCI_DMA_TODEVICE);
- kfree(new_table);
- }
+ kfree(new_table);
}
void
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 29ee77f2..3759479 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
/*
* Version numbers
*/
-#define VMXNET3_DRIVER_VERSION_STRING "1.2.0.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING "1.2.1.0-k"
/* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM 0x01020000
+#define VMXNET3_DRIVER_VERSION_NUM 0x01020100
#if defined(CONFIG_PCI_MSI)
/* RSS only makes sense if MSI-X is supported. */
--
1.7.4.1
^ permalink raw reply related
* Re: [PATCH 3/6] drivers: net: ethernet: cpsw: add multicast address to ALE table
From: Graeme Smecher @ 2014-09-02 18:22 UTC (permalink / raw)
To: netdev; +Cc: Mugunthan V N
Hi Mugunthan,
> On Wed, Oct 17, 2012 at 04:15:15AM +0530, Mugunthan V N wrote:
> > Adding multicast address to ALE table via netdev ops to subscribe, transmit
> > or receive multicast frames to and from the network
>
> Is this somehow related to the time stamping function? If so, how?
>
> Thanks,
> Richard
Can you give me a brief description of this (relatively ancient) patch? Your
original e-mail is visible here:
http://marc.info/?l=linux-netdev&m=135042754927177&w=2
I'm wondering if this patch needs to be backported to older CPSW driver
snapshots (specifically, TI's 2.6.37 branch for dm81xx.) It appears to
fix a multicast bug I'm tracking down, but it's difficult to know for
sure without a good description of what problem the patch addresses. (I
don't want to commit code that fixes my hardware by accident.)
For a little more information, you can refer to my e2e.ti.com post:
http://e2e.ti.com/support/dsp/davinci_digital_media_processors/f/716/t/365586.aspx
I'm slowly learning about ALE filtering, but a quick reply from a
domain expert would be very helpful.
best,
Graeme
^ permalink raw reply
* Re: [PATCH] openvswitch: fix a memory leak
From: Pravin Shelar @ 2014-09-02 20:18 UTC (permalink / raw)
To: roy.qing.li; +Cc: netdev, dev@openvswitch.org
In-Reply-To: <1409662348-2475-1-git-send-email-roy.qing.li@gmail.com>
On Tue, Sep 2, 2014 at 5:52 AM, <roy.qing.li@gmail.com> wrote:
> From: Li RongQing <roy.qing.li@gmail.com>
>
> The user_skb maybe be leaked if the operation on it failed and codes
> skipped into the label "out:" without calling genlmsg_unicast.
>
> Cc: Pravin Shelar <pshelar@nicira.com>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Looks good.
Acked-by: Pravin B Shelar <pshelar@nicira.com>
> ---
> net/openvswitch/datapath.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
> index 7228ec3..35d866f 100644
> --- a/net/openvswitch/datapath.c
> +++ b/net/openvswitch/datapath.c
> @@ -404,7 +404,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
> {
> struct ovs_header *upcall;
> struct sk_buff *nskb = NULL;
> - struct sk_buff *user_skb; /* to be queued to userspace */
> + struct sk_buff *user_skb = NULL; /* to be queued to userspace */
> struct nlattr *nla;
> struct genl_info info = {
> .dst_sk = ovs_dp_get_net(dp)->genl_sock,
> @@ -494,9 +494,11 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
> ((struct nlmsghdr *) user_skb->data)->nlmsg_len = user_skb->len;
>
> err = genlmsg_unicast(ovs_dp_get_net(dp), user_skb, upcall_info->portid);
> + user_skb = NULL;
> out:
> if (err)
> skb_tx_error(skb);
> + kfree_skb(user_skb);
> kfree_skb(nskb);
> return err;
> }
> --
> 1.7.10.4
>
^ permalink raw reply
* Re: [ovs-dev] [PATCH] openvswitch: distinguish between the dropped and consumed skb
From: Pravin Shelar @ 2014-09-02 20:20 UTC (permalink / raw)
To: Thomas Graf; +Cc: roy.qing.li, netdev, dev@openvswitch.org
In-Reply-To: <20140902131437.GB14751@pox.localdomain>
On Tue, Sep 2, 2014 at 6:14 AM, Thomas Graf <tgraf@noironetworks.com> wrote:
> On 09/02/14 at 08:52pm, roy.qing.li@gmail.com wrote:
>> @@ -304,9 +303,11 @@ int ovs_dp_upcall(struct datapath *dp, struct sk_buff *skb,
>> if (err)
>> goto err;
>>
>> + consume_skb(skb);
>> return 0;
>
> What about the path from output_userspace()?
Right, output_userspace() can not free the skb in any case.
^ permalink raw reply
* Re: [PATCH] net: lpc_eth: Fix crash on ip link up
From: David Miller @ 2014-09-02 20:22 UTC (permalink / raw)
To: stigge; +Cc: netdev, linux-kernel
In-Reply-To: <1409572006-26876-1-git-send-email-stigge@antcom.de>
From: stigge@antcom.de
Date: Mon, 1 Sep 2014 13:46:46 +0200
> From: Roland Stigge <stigge@antcom.de>
>
> When a link is already up, the following sequence makes the kernel
> block completely:
>
> ip link set dev eth0 down
> ip link set dev eth0 up
>
> This is because on suspended phy, the following lines
>
> __lpc_eth_reset(pldat);
> __lpc_eth_init(pldat);
>
> make the LPC ethernet core block (see LPC32x0 manual). The PHY needs to be
> (re-)activated low-level first.
>
> Signed-off-by: Roland Stigge <stigge@antcom.de>
Applied, thanks.
^ permalink raw reply
* Re: [PATCH v2] net: sh_eth: fix driver dependencies
From: David Miller @ 2014-09-02 20:23 UTC (permalink / raw)
To: b.zolnierkie
Cc: horms, magnus.damm, kyungmin.park, netdev, linux-sh, linux-kernel
In-Reply-To: <1749721.1a6rN6K2Gg@amdc1032>
From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Date: Mon, 01 Sep 2014 16:25:35 +0200
> Renesas SuperH Ethernet support should be available only on
> Renesas ARM SoCs and SuperH architecture.
>
> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
> Acked-by: Kyungmin Park <kyungmin.park@samsung.com>
Applied.
^ permalink raw reply
* Re: [PATCH] net: calxedaxgmac: fix driver dependencies
From: David Miller @ 2014-09-02 20:23 UTC (permalink / raw)
To: b.zolnierkie; +Cc: robh, kyungmin.park, netdev, linux-kernel
In-Reply-To: <7268934.nBXHizFkl4@amdc1032>
From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Date: Mon, 01 Sep 2014 17:39:04 +0200
> Calxeda 1G/10G XGMAC Ethernet support should be available only on
> Calxeda ECX-1000/2000 (Highbank/Midway) platforms.
>
> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
> Acked-by: Kyungmin Park <kyungmin.park@samsung.com>
Applied.
^ permalink raw reply
* [PATCH] net: export pkt_type_offset() helper
From: Denis Kirjanov @ 2014-09-02 20:03 UTC (permalink / raw)
To: netdev; +Cc: Denis Kirjanov, Markos Chandras, Martin Schwidefsky,
Daniel Borkmann
Currently we have 2 pkt_type_offset functions doing
the same thing and spread across the architecture files.
Let's use the generic helper routine.
Signed-off-by: Denis Kirjanov <kda@linux-powerpc.org>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
---
arch/mips/net/bpf_jit.c | 21 ---------------------
arch/s390/net/bpf_jit_comp.c | 38 ++++----------------------------------
include/linux/filter.h | 7 +++++++
net/core/filter.c | 7 +------
4 files changed, 12 insertions(+), 61 deletions(-)
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 05a5661..08ff823 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -765,27 +765,6 @@ static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
return (u64)err << 32 | ntohl(ret);
}
-#ifdef __BIG_ENDIAN_BITFIELD
-#define PKT_TYPE_MAX (7 << 5)
-#else
-#define PKT_TYPE_MAX 7
-#endif
-static int pkt_type_offset(void)
-{
- struct sk_buff skb_probe = {
- .pkt_type = ~0,
- };
- u8 *ct = (u8 *)&skb_probe;
- unsigned int off;
-
- for (off = 0; off < sizeof(struct sk_buff); off++) {
- if (ct[off] == PKT_TYPE_MAX)
- return off;
- }
- pr_err_once("Please fix pkt_type_offset(), as pkt_type couldn't be found\n");
- return -1;
-}
-
static int build_body(struct jit_ctx *ctx)
{
void *load_func[] = {jit_get_skb_b, jit_get_skb_h, jit_get_skb_w};
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 61e45b7..34383d1 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -223,37 +223,6 @@ static void bpf_jit_epilogue(struct bpf_jit *jit)
EMIT2(0x07fe);
}
-/* Helper to find the offset of pkt_type in sk_buff
- * Make sure its still a 3bit field starting at the MSBs within a byte.
- */
-#define PKT_TYPE_MAX 0xe0
-static int pkt_type_offset;
-
-static int __init bpf_pkt_type_offset_init(void)
-{
- struct sk_buff skb_probe = {
- .pkt_type = ~0,
- };
- char *ct = (char *)&skb_probe;
- int off;
-
- pkt_type_offset = -1;
- for (off = 0; off < sizeof(struct sk_buff); off++) {
- if (!ct[off])
- continue;
- if (ct[off] == PKT_TYPE_MAX)
- pkt_type_offset = off;
- else {
- /* Found non matching bit pattern, fix needed. */
- WARN_ON_ONCE(1);
- pkt_type_offset = -1;
- return -1;
- }
- }
- return 0;
-}
-device_initcall(bpf_pkt_type_offset_init);
-
/*
* make sure we dont leak kernel information to user
*/
@@ -753,12 +722,13 @@ call_fn: /* lg %r1,<d(function)>(%r13) */
}
break;
case BPF_ANC | SKF_AD_PKTTYPE:
- if (pkt_type_offset < 0)
+ offset = pkt_type_offset();
+ if (offset < 0)
goto out;
/* lhi %r5,0 */
EMIT4(0xa7580000);
- /* ic %r5,<d(pkt_type_offset)>(%r2) */
- EMIT4_DISP(0x43502000, pkt_type_offset);
+ /* ic %r5,<d(offset)>(%r2) */
+ EMIT4_DISP(0x43502000, offset);
/* srl %r5,5 */
EMIT4_DISP(0x88500000, 5);
break;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a5227ab..97e0549 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -424,6 +424,13 @@ static inline void *bpf_load_pointer(const struct sk_buff *skb, int k,
return bpf_internal_load_pointer_neg_helper(skb, k, size);
}
+#ifdef __BIG_ENDIAN_BITFIELD
+#define PKT_TYPE_MAX (7 << 5)
+#else
+#define PKT_TYPE_MAX 7
+#endif
+unsigned int pkt_type_offset(void);
+
#ifdef CONFIG_BPF_JIT
#include <stdarg.h>
#include <linux/linkage.h>
diff --git a/net/core/filter.c b/net/core/filter.c
index d814b8a..b4a2e00 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -91,12 +91,7 @@ EXPORT_SYMBOL(sk_filter);
* to make sure its still a 3bit field starting at a byte boundary;
* taken from arch/x86/net/bpf_jit_comp.c.
*/
-#ifdef __BIG_ENDIAN_BITFIELD
-#define PKT_TYPE_MAX (7 << 5)
-#else
-#define PKT_TYPE_MAX 7
-#endif
-static unsigned int pkt_type_offset(void)
+unsigned int pkt_type_offset(void)
{
struct sk_buff skb_probe = { .pkt_type = ~0, };
u8 *ct = (u8 *) &skb_probe;
--
2.0.0
^ permalink raw reply related
* [PATCH net-next] net: bpf: make eBPF interpreter images read-only
From: Hannes Frederic Sowa @ 2014-09-02 20:42 UTC (permalink / raw)
To: netdev
Cc: linux-kernel, Brad Spengler, Daniel Borkmann, Alexei Starovoitov,
Kees Cook
From: Daniel Borkmann <dborkman@redhat.com>
With eBPF getting more extended and exposure to user space is on it's way,
hardening the memory range the interpreter uses to steer its command flow
seems appropriate. This patch moves the to be interpreted bytecode to
read-only pages.
In case we execute a corrupted BPF interpreter image for some reason e.g.
caused by an attacker which got past a verifier stage, it would not only
provide arbitrary read/write memory access but arbitrary function calls
as well. After setting up the BPF interpreter image, its contents do not
change until destruction time, thus we can setup the image on immutable
made pages in order to mitigate modifications to that code. The idea
is derived from commit 314beb9bcabf ("x86: bpf_jit_comp: secure bpf jit
against spraying attacks").
Therefore, introduce a page allocator for eBPF and RO locking mechanisms
in order to mitigate modifications to that code. The idea is derived
from commit 314beb9bcabf ("x86: bpf_jit_comp: secure bpf jit against
spraying attacks").
This is possible because bpf_prog is not part of sk_filter anymore.
After setup bpf_prog cannot be altered during its life-time. This prevents
any modifications to the entire bpf_prog structure (incl. function/JIT
image pointer).
Every eBPF program (including classic BPF that are migrated) have to call
bpf_prog_select_runtime() to select either interpreter or a JIT image
as a last setup step, and they all are being freed via bpf_prog_free(),
including non-JIT. Therefore, we can easily integrate this into the
eBPF life-time, plus since we directly allocate a bpf_prog, we have no
performance penalty.
Tested with seccomp and test_bpf testsuite in JIT/non-JIT mode and manual
inspection of kernel_page_tables. Brad Spengler proposed the same idea
via Twitter during development of this patch.
Joint work with Hannes Frederic Sowa.
Suggested-by: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Kees Cook <keescook@chromium.org>
---
arch/arm/net/bpf_jit_32.c | 3 +-
arch/mips/net/bpf_jit.c | 3 +-
arch/powerpc/net/bpf_jit_comp.c | 3 +-
arch/s390/net/bpf_jit_comp.c | 2 +-
arch/sparc/net/bpf_jit_comp.c | 3 +-
arch/x86/net/bpf_jit_comp.c | 18 ++++------
include/linux/filter.h | 49 ++++++++++++++++++++++---
kernel/bpf/core.c | 80 +++++++++++++++++++++++++++++++++++++++--
kernel/seccomp.c | 7 ++--
lib/test_bpf.c | 2 +-
net/core/filter.c | 6 ++--
11 files changed, 144 insertions(+), 32 deletions(-)
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index a37b989..a76623b 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -930,5 +930,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 05a5661..cfa83cf 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -1427,5 +1427,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 3afa6f4..40c53ff 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -697,5 +697,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 61e45b7..f2833c5 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -887,5 +887,5 @@ void bpf_jit_free(struct bpf_prog *fp)
module_free(NULL, header);
free_filter:
- kfree(fp);
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 1f76c22..f7a736b 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -812,5 +812,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index b08a98c..39ccfbb 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -972,23 +972,17 @@ out:
kfree(addrs);
}
-static void bpf_jit_free_deferred(struct work_struct *work)
+void bpf_jit_free(struct bpf_prog *fp)
{
- struct bpf_prog *fp = container_of(work, struct bpf_prog, work);
unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
struct bpf_binary_header *header = (void *)addr;
+ if (!fp->jited)
+ goto free_filter;
+
set_memory_rw(addr, header->pages);
module_free(NULL, header);
- kfree(fp);
-}
-void bpf_jit_free(struct bpf_prog *fp)
-{
- if (fp->jited) {
- INIT_WORK(&fp->work, bpf_jit_free_deferred);
- schedule_work(&fp->work);
- } else {
- kfree(fp);
- }
+free_filter:
+ bpf_prog_unlock_free(fp);
}
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a5227ab..c789945 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -9,6 +9,11 @@
#include <linux/skbuff.h>
#include <linux/workqueue.h>
#include <uapi/linux/filter.h>
+#include <asm/cacheflush.h>
+
+struct sk_buff;
+struct sock;
+struct seccomp_data;
/* Internally used and optimized filter representation with extended
* instruction set based on top of classic BPF.
@@ -320,20 +325,23 @@ struct sock_fprog_kern {
struct sock_filter *filter;
};
-struct sk_buff;
-struct sock;
-struct seccomp_data;
+struct bpf_work_struct {
+ struct bpf_prog *prog;
+ struct work_struct work;
+};
struct bpf_prog {
+ u32 pages; /* Number of allocated pages */
u32 jited:1, /* Is our filter JIT'ed? */
len:31; /* Number of filter blocks */
struct sock_fprog_kern *orig_prog; /* Original BPF program */
+ struct bpf_work_struct *work; /* Deferred free work struct */
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
+ /* Instructions for interpreter */
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
- struct work_struct work;
};
};
@@ -353,6 +361,26 @@ static inline unsigned int bpf_prog_size(unsigned int proglen)
#define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0]))
+#ifdef CONFIG_DEBUG_SET_MODULE_RONX
+static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
+{
+ set_memory_ro((unsigned long)fp, fp->pages);
+}
+
+static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
+{
+ set_memory_rw((unsigned long)fp, fp->pages);
+}
+#else
+static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
+{
+}
+
+static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
+{
+}
+#endif /* CONFIG_DEBUG_SET_MODULE_RONX */
+
int sk_filter(struct sock *sk, struct sk_buff *skb);
void bpf_prog_select_runtime(struct bpf_prog *fp);
@@ -361,6 +389,17 @@ void bpf_prog_free(struct bpf_prog *fp);
int bpf_convert_filter(struct sock_filter *prog, int len,
struct bpf_insn *new_prog, int *new_len);
+struct bpf_prog *bpf_prog_alloc(unsigned int size, gfp_t gfp_extra_flags);
+struct bpf_prog *bpf_prog_realloc(struct bpf_prog *fp_old, unsigned int size,
+ gfp_t gfp_extra_flags);
+void __bpf_prog_free(struct bpf_prog *fp);
+
+static inline void bpf_prog_unlock_free(struct bpf_prog *fp)
+{
+ bpf_prog_unlock_ro(fp);
+ __bpf_prog_free(fp);
+}
+
int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog);
void bpf_prog_destroy(struct bpf_prog *fp);
@@ -450,7 +489,7 @@ static inline void bpf_jit_compile(struct bpf_prog *fp)
static inline void bpf_jit_free(struct bpf_prog *fp)
{
- kfree(fp);
+ bpf_prog_unlock_free(fp);
}
#endif /* CONFIG_BPF_JIT */
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 7f0dbcb..b54bb2c 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -22,6 +22,7 @@
*/
#include <linux/filter.h>
#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
#include <asm/unaligned.h>
/* Registers */
@@ -63,6 +64,67 @@ void *bpf_internal_load_pointer_neg_helper(const struct sk_buff *skb, int k, uns
return NULL;
}
+struct bpf_prog *bpf_prog_alloc(unsigned int size, gfp_t gfp_extra_flags)
+{
+ gfp_t gfp_flags = GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO |
+ gfp_extra_flags;
+ struct bpf_work_struct *ws;
+ struct bpf_prog *fp;
+
+ size = round_up(size, PAGE_SIZE);
+ fp = __vmalloc(size, gfp_flags, PAGE_KERNEL);
+ if (fp == NULL)
+ return NULL;
+
+ ws = kmalloc(sizeof(*ws), GFP_KERNEL | gfp_extra_flags);
+ if (ws == NULL) {
+ vfree(fp);
+ return NULL;
+ }
+
+ fp->pages = size / PAGE_SIZE;
+ fp->work = ws;
+
+ return fp;
+}
+EXPORT_SYMBOL_GPL(bpf_prog_alloc);
+
+struct bpf_prog *bpf_prog_realloc(struct bpf_prog *fp_old, unsigned int size,
+ gfp_t gfp_extra_flags)
+{
+ gfp_t gfp_flags = GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO |
+ gfp_extra_flags;
+ struct bpf_prog *fp;
+
+ BUG_ON(fp_old == NULL);
+
+ size = round_up(size, PAGE_SIZE);
+ if (size <= fp_old->pages * PAGE_SIZE)
+ return fp_old;
+
+ fp = __vmalloc(size, gfp_flags, PAGE_KERNEL);
+ if (fp != NULL) {
+ memcpy(fp, fp_old, fp_old->pages * PAGE_SIZE);
+ fp->pages = size / PAGE_SIZE;
+
+ /* We keep fp->work from fp_old around in the new
+ * reallocated structure.
+ */
+ fp_old->work = NULL;
+ __bpf_prog_free(fp_old);
+ }
+
+ return fp;
+}
+EXPORT_SYMBOL_GPL(bpf_prog_realloc);
+
+void __bpf_prog_free(struct bpf_prog *fp)
+{
+ kfree(fp->work);
+ vfree(fp);
+}
+EXPORT_SYMBOL_GPL(__bpf_prog_free);
+
/* Base function for offset calculation. Needs to go into .text section,
* therefore keeping it non-static as well; will also be used by JITs
* anyway later on, so do not let the compiler omit it.
@@ -523,12 +585,26 @@ void bpf_prog_select_runtime(struct bpf_prog *fp)
/* Probe if internal BPF can be JITed */
bpf_int_jit_compile(fp);
+ /* Lock whole bpf_prog as read-only */
+ bpf_prog_lock_ro(fp);
}
EXPORT_SYMBOL_GPL(bpf_prog_select_runtime);
-/* free internal BPF program */
+static void bpf_prog_free_deferred(struct work_struct *work)
+{
+ struct bpf_work_struct *ws;
+
+ ws = container_of(work, struct bpf_work_struct, work);
+ bpf_jit_free(ws->prog);
+}
+
+/* Free internal BPF program */
void bpf_prog_free(struct bpf_prog *fp)
{
- bpf_jit_free(fp);
+ struct bpf_work_struct *ws = fp->work;
+
+ INIT_WORK(&ws->work, bpf_prog_free_deferred);
+ ws->prog = fp;
+ schedule_work(&ws->work);
}
EXPORT_SYMBOL_GPL(bpf_prog_free);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 44eb005..84922be 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -395,16 +395,15 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
if (!filter)
goto free_prog;
- filter->prog = kzalloc(bpf_prog_size(new_len),
- GFP_KERNEL|__GFP_NOWARN);
+ filter->prog = bpf_prog_alloc(bpf_prog_size(new_len), __GFP_NOWARN);
if (!filter->prog)
goto free_filter;
ret = bpf_convert_filter(fp, fprog->len, filter->prog->insnsi, &new_len);
if (ret)
goto free_filter_prog;
- kfree(fp);
+ kfree(fp);
atomic_set(&filter->usage, 1);
filter->prog->len = new_len;
@@ -413,7 +412,7 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
return filter;
free_filter_prog:
- kfree(filter->prog);
+ __bpf_prog_free(filter->prog);
free_filter:
kfree(filter);
free_prog:
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 8c66c6a..9a67456 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -1836,7 +1836,7 @@ static struct bpf_prog *generate_filter(int which, int *err)
break;
case INTERNAL:
- fp = kzalloc(bpf_prog_size(flen), GFP_KERNEL);
+ fp = bpf_prog_alloc(bpf_prog_size(flen), 0);
if (fp == NULL) {
pr_cont("UNEXPECTED_FAIL no memory left\n");
*err = -ENOMEM;
diff --git a/net/core/filter.c b/net/core/filter.c
index d814b8a..37f8eb0 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -933,7 +933,7 @@ static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
/* Expand fp for appending the new filter representation. */
old_fp = fp;
- fp = krealloc(old_fp, bpf_prog_size(new_len), GFP_KERNEL);
+ fp = bpf_prog_realloc(old_fp, bpf_prog_size(new_len), 0);
if (!fp) {
/* The old_fp is still around in case we couldn't
* allocate new memory, so uncharge on that one.
@@ -1013,7 +1013,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
if (fprog->filter == NULL)
return -EINVAL;
- fp = kmalloc(bpf_prog_size(fprog->len), GFP_KERNEL);
+ fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0);
if (!fp)
return -ENOMEM;
@@ -1069,7 +1069,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
if (fprog->filter == NULL)
return -EINVAL;
- prog = kmalloc(bpf_fsize, GFP_KERNEL);
+ prog = bpf_prog_alloc(bpf_fsize, 0);
if (!prog)
return -ENOMEM;
--
1.9.3
^ permalink raw reply related
* Re: [PATCH] ethernet: nvidia: Remove extra parens
From: David Miller @ 2014-09-02 20:47 UTC (permalink / raw)
To: devel
Cc: netdev, agordeev, ebiederm, ao2, paul.gortmaker, jiri,
jeffrey.t.kirsher, w-lkml, ivecera, linux-kernel, trivial
In-Reply-To: <20140901223152.GA3066@dtw-laptop.attlocal.net>
From: David Wood <devel@dtwood.uk>
Date: Mon, 1 Sep 2014 15:31:55 -0700
> Remove unnecessary double parenthesis around if statement.
>
> Signed-off-by: David Wood <devel@dtwood.uk>
Applied, thank you.
^ permalink raw reply
* Re: [PATCH net-next 0/3] fec: Do not use NULL pointer to indicate error
From: David Miller @ 2014-09-02 20:48 UTC (permalink / raw)
To: festevam; +Cc: linux, B38611, netdev, fabio.estevam
In-Reply-To: <1409620375-20284-1-git-send-email-festevam@gmail.com>
From: Fabio Estevam <festevam@gmail.com>
Date: Mon, 1 Sep 2014 22:12:52 -0300
> Using IS_ERR() to indicate error can simplify the code a bit, so let's use
> it when appropriate.
I would rather you not do this.
Generally speaking we should not leave pointer error values in
structure pointers.
It's just asking for someone to later accidently kfree or
release the "object" because pointer errors evaluate to
non-NULL.
^ permalink raw reply
* Re: [net-next PATCH v2 02/15] net: rcu-ify tcf_proto
From: David Miller @ 2014-09-02 20:52 UTC (permalink / raw)
To: john.fastabend; +Cc: xiyou.wangcong, jhs, eric.dumazet, netdev, paulmck, brouer
In-Reply-To: <54051FC1.6030106@gmail.com>
From: John Fastabend <john.fastabend@gmail.com>
Date: Mon, 01 Sep 2014 18:39:13 -0700
> On 08/24/2014 10:31 PM, David Miller wrote:
>> From: John Fastabend <john.fastabend@gmail.com>
>> Date: Sun, 24 Aug 2014 17:48:31 -0700
>>
>>> @@ -722,8 +724,9 @@ static void sfq_free(void *addr)
>>> static void sfq_destroy(struct Qdisc *sch)
>>> {
>>> struct sfq_sched_data *q = qdisc_priv(sch);
>>> + struct tcf_proto *fl = rtnl_dereference(q->filter_list);
>>>
>>> - tcf_destroy_chain(&q->filter_list);
>>> + tcf_destroy_chain(&fl);
>
> Sorry for the delayed reply...
>
>>
>> This will cause tcf_destroy_chain() to set the local variable
>> 'fl' to NULL rather than q->filter_list.
>>
>> I don't see how this can be correct at all.
>
> Right now (without these patches) nothing sets q->filter_list
> to NULL and we only call this when the qdisc is being destroyed.
Yes, it does set it to NULL, by virtue of how the loop iterates.
It iterates by setting the "*fl" to tp->next until that evaluates to
NULL. Thereby setting *fl to NULL.
So the old code would set ->filter_list to NULL, your code will not.
^ permalink raw reply
* Re: [PATCH] ethernet: arc: remove unused dev
From: David Miller @ 2014-09-02 20:53 UTC (permalink / raw)
To: jg1.han; +Cc: netdev, romain.perier
In-Reply-To: <001a01cfc64f$f4421040$dcc630c0$%han@samsung.com>
From: Jingoo Han <jg1.han@samsung.com>
Date: Tue, 02 Sep 2014 10:48:11 +0900
> Remove unused 'dev' variable from arc_emac_remove(), since it's
> not being used any more.
>
> Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Applied, thanks.
^ permalink raw reply
* [PATCH net-next v2] net: bpf: make eBPF interpreter images read-only
From: Hannes Frederic Sowa @ 2014-09-02 20:53 UTC (permalink / raw)
To: netdev
Cc: linux-kernel, Brad Spengler, Daniel Borkmann, Alexei Starovoitov,
Kees Cook
In-Reply-To: <aa5126f747594d768e0c518189a13e8674ad8ee5.1409690486.git.hannes@stressinduktion.org>
From: Daniel Borkmann <dborkman@redhat.com>
With eBPF getting more extended and exposure to user space is on it's way,
hardening the memory range the interpreter uses to steer its command flow
seems appropriate. This patch moves the to be interpreted bytecode to
read-only pages.
In case we execute a corrupted BPF interpreter image for some reason e.g.
caused by an attacker which got past a verifier stage, it would not only
provide arbitrary read/write memory access but arbitrary function calls
as well. After setting up the BPF interpreter image, its contents do not
change until destruction time, thus we can setup the image on immutable
made pages in order to mitigate modifications to that code. The idea
is derived from commit 314beb9bcabf ("x86: bpf_jit_comp: secure bpf jit
against spraying attacks").
This is possible because bpf_prog is not part of sk_filter anymore.
After setup bpf_prog cannot be altered during its life-time. This prevents
any modifications to the entire bpf_prog structure (incl. function/JIT
image pointer).
Every eBPF program (including classic BPF that are migrated) have to call
bpf_prog_select_runtime() to select either interpreter or a JIT image
as a last setup step, and they all are being freed via bpf_prog_free(),
including non-JIT. Therefore, we can easily integrate this into the
eBPF life-time, plus since we directly allocate a bpf_prog, we have no
performance penalty.
Tested with seccomp and test_bpf testsuite in JIT/non-JIT mode and manual
inspection of kernel_page_tables. Brad Spengler proposed the same idea
via Twitter during development of this patch.
Joint work with Hannes Frederic Sowa.
Suggested-by: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Kees Cook <keescook@chromium.org>
---
v2) During proofreading I accidentally did not remove the old duplicate
paragraph from the changelog.
arch/arm/net/bpf_jit_32.c | 3 +-
arch/mips/net/bpf_jit.c | 3 +-
arch/powerpc/net/bpf_jit_comp.c | 3 +-
arch/s390/net/bpf_jit_comp.c | 2 +-
arch/sparc/net/bpf_jit_comp.c | 3 +-
arch/x86/net/bpf_jit_comp.c | 18 ++++------
include/linux/filter.h | 49 ++++++++++++++++++++++---
kernel/bpf/core.c | 80 +++++++++++++++++++++++++++++++++++++++--
kernel/seccomp.c | 7 ++--
lib/test_bpf.c | 2 +-
net/core/filter.c | 6 ++--
11 files changed, 144 insertions(+), 32 deletions(-)
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index a37b989..a76623b 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -930,5 +930,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 05a5661..cfa83cf 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -1427,5 +1427,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 3afa6f4..40c53ff 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -697,5 +697,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 61e45b7..f2833c5 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -887,5 +887,5 @@ void bpf_jit_free(struct bpf_prog *fp)
module_free(NULL, header);
free_filter:
- kfree(fp);
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 1f76c22..f7a736b 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -812,5 +812,6 @@ void bpf_jit_free(struct bpf_prog *fp)
{
if (fp->jited)
module_free(NULL, fp->bpf_func);
- kfree(fp);
+
+ bpf_prog_unlock_free(fp);
}
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index b08a98c..39ccfbb 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -972,23 +972,17 @@ out:
kfree(addrs);
}
-static void bpf_jit_free_deferred(struct work_struct *work)
+void bpf_jit_free(struct bpf_prog *fp)
{
- struct bpf_prog *fp = container_of(work, struct bpf_prog, work);
unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
struct bpf_binary_header *header = (void *)addr;
+ if (!fp->jited)
+ goto free_filter;
+
set_memory_rw(addr, header->pages);
module_free(NULL, header);
- kfree(fp);
-}
-void bpf_jit_free(struct bpf_prog *fp)
-{
- if (fp->jited) {
- INIT_WORK(&fp->work, bpf_jit_free_deferred);
- schedule_work(&fp->work);
- } else {
- kfree(fp);
- }
+free_filter:
+ bpf_prog_unlock_free(fp);
}
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a5227ab..c789945 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -9,6 +9,11 @@
#include <linux/skbuff.h>
#include <linux/workqueue.h>
#include <uapi/linux/filter.h>
+#include <asm/cacheflush.h>
+
+struct sk_buff;
+struct sock;
+struct seccomp_data;
/* Internally used and optimized filter representation with extended
* instruction set based on top of classic BPF.
@@ -320,20 +325,23 @@ struct sock_fprog_kern {
struct sock_filter *filter;
};
-struct sk_buff;
-struct sock;
-struct seccomp_data;
+struct bpf_work_struct {
+ struct bpf_prog *prog;
+ struct work_struct work;
+};
struct bpf_prog {
+ u32 pages; /* Number of allocated pages */
u32 jited:1, /* Is our filter JIT'ed? */
len:31; /* Number of filter blocks */
struct sock_fprog_kern *orig_prog; /* Original BPF program */
+ struct bpf_work_struct *work; /* Deferred free work struct */
unsigned int (*bpf_func)(const struct sk_buff *skb,
const struct bpf_insn *filter);
+ /* Instructions for interpreter */
union {
struct sock_filter insns[0];
struct bpf_insn insnsi[0];
- struct work_struct work;
};
};
@@ -353,6 +361,26 @@ static inline unsigned int bpf_prog_size(unsigned int proglen)
#define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0]))
+#ifdef CONFIG_DEBUG_SET_MODULE_RONX
+static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
+{
+ set_memory_ro((unsigned long)fp, fp->pages);
+}
+
+static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
+{
+ set_memory_rw((unsigned long)fp, fp->pages);
+}
+#else
+static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
+{
+}
+
+static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
+{
+}
+#endif /* CONFIG_DEBUG_SET_MODULE_RONX */
+
int sk_filter(struct sock *sk, struct sk_buff *skb);
void bpf_prog_select_runtime(struct bpf_prog *fp);
@@ -361,6 +389,17 @@ void bpf_prog_free(struct bpf_prog *fp);
int bpf_convert_filter(struct sock_filter *prog, int len,
struct bpf_insn *new_prog, int *new_len);
+struct bpf_prog *bpf_prog_alloc(unsigned int size, gfp_t gfp_extra_flags);
+struct bpf_prog *bpf_prog_realloc(struct bpf_prog *fp_old, unsigned int size,
+ gfp_t gfp_extra_flags);
+void __bpf_prog_free(struct bpf_prog *fp);
+
+static inline void bpf_prog_unlock_free(struct bpf_prog *fp)
+{
+ bpf_prog_unlock_ro(fp);
+ __bpf_prog_free(fp);
+}
+
int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog);
void bpf_prog_destroy(struct bpf_prog *fp);
@@ -450,7 +489,7 @@ static inline void bpf_jit_compile(struct bpf_prog *fp)
static inline void bpf_jit_free(struct bpf_prog *fp)
{
- kfree(fp);
+ bpf_prog_unlock_free(fp);
}
#endif /* CONFIG_BPF_JIT */
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 7f0dbcb..b54bb2c 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -22,6 +22,7 @@
*/
#include <linux/filter.h>
#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
#include <asm/unaligned.h>
/* Registers */
@@ -63,6 +64,67 @@ void *bpf_internal_load_pointer_neg_helper(const struct sk_buff *skb, int k, uns
return NULL;
}
+struct bpf_prog *bpf_prog_alloc(unsigned int size, gfp_t gfp_extra_flags)
+{
+ gfp_t gfp_flags = GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO |
+ gfp_extra_flags;
+ struct bpf_work_struct *ws;
+ struct bpf_prog *fp;
+
+ size = round_up(size, PAGE_SIZE);
+ fp = __vmalloc(size, gfp_flags, PAGE_KERNEL);
+ if (fp == NULL)
+ return NULL;
+
+ ws = kmalloc(sizeof(*ws), GFP_KERNEL | gfp_extra_flags);
+ if (ws == NULL) {
+ vfree(fp);
+ return NULL;
+ }
+
+ fp->pages = size / PAGE_SIZE;
+ fp->work = ws;
+
+ return fp;
+}
+EXPORT_SYMBOL_GPL(bpf_prog_alloc);
+
+struct bpf_prog *bpf_prog_realloc(struct bpf_prog *fp_old, unsigned int size,
+ gfp_t gfp_extra_flags)
+{
+ gfp_t gfp_flags = GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO |
+ gfp_extra_flags;
+ struct bpf_prog *fp;
+
+ BUG_ON(fp_old == NULL);
+
+ size = round_up(size, PAGE_SIZE);
+ if (size <= fp_old->pages * PAGE_SIZE)
+ return fp_old;
+
+ fp = __vmalloc(size, gfp_flags, PAGE_KERNEL);
+ if (fp != NULL) {
+ memcpy(fp, fp_old, fp_old->pages * PAGE_SIZE);
+ fp->pages = size / PAGE_SIZE;
+
+ /* We keep fp->work from fp_old around in the new
+ * reallocated structure.
+ */
+ fp_old->work = NULL;
+ __bpf_prog_free(fp_old);
+ }
+
+ return fp;
+}
+EXPORT_SYMBOL_GPL(bpf_prog_realloc);
+
+void __bpf_prog_free(struct bpf_prog *fp)
+{
+ kfree(fp->work);
+ vfree(fp);
+}
+EXPORT_SYMBOL_GPL(__bpf_prog_free);
+
/* Base function for offset calculation. Needs to go into .text section,
* therefore keeping it non-static as well; will also be used by JITs
* anyway later on, so do not let the compiler omit it.
@@ -523,12 +585,26 @@ void bpf_prog_select_runtime(struct bpf_prog *fp)
/* Probe if internal BPF can be JITed */
bpf_int_jit_compile(fp);
+ /* Lock whole bpf_prog as read-only */
+ bpf_prog_lock_ro(fp);
}
EXPORT_SYMBOL_GPL(bpf_prog_select_runtime);
-/* free internal BPF program */
+static void bpf_prog_free_deferred(struct work_struct *work)
+{
+ struct bpf_work_struct *ws;
+
+ ws = container_of(work, struct bpf_work_struct, work);
+ bpf_jit_free(ws->prog);
+}
+
+/* Free internal BPF program */
void bpf_prog_free(struct bpf_prog *fp)
{
- bpf_jit_free(fp);
+ struct bpf_work_struct *ws = fp->work;
+
+ INIT_WORK(&ws->work, bpf_prog_free_deferred);
+ ws->prog = fp;
+ schedule_work(&ws->work);
}
EXPORT_SYMBOL_GPL(bpf_prog_free);
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 44eb005..84922be 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -395,16 +395,15 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
if (!filter)
goto free_prog;
- filter->prog = kzalloc(bpf_prog_size(new_len),
- GFP_KERNEL|__GFP_NOWARN);
+ filter->prog = bpf_prog_alloc(bpf_prog_size(new_len), __GFP_NOWARN);
if (!filter->prog)
goto free_filter;
ret = bpf_convert_filter(fp, fprog->len, filter->prog->insnsi, &new_len);
if (ret)
goto free_filter_prog;
- kfree(fp);
+ kfree(fp);
atomic_set(&filter->usage, 1);
filter->prog->len = new_len;
@@ -413,7 +412,7 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
return filter;
free_filter_prog:
- kfree(filter->prog);
+ __bpf_prog_free(filter->prog);
free_filter:
kfree(filter);
free_prog:
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 8c66c6a..9a67456 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -1836,7 +1836,7 @@ static struct bpf_prog *generate_filter(int which, int *err)
break;
case INTERNAL:
- fp = kzalloc(bpf_prog_size(flen), GFP_KERNEL);
+ fp = bpf_prog_alloc(bpf_prog_size(flen), 0);
if (fp == NULL) {
pr_cont("UNEXPECTED_FAIL no memory left\n");
*err = -ENOMEM;
diff --git a/net/core/filter.c b/net/core/filter.c
index d814b8a..37f8eb0 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -933,7 +933,7 @@ static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
/* Expand fp for appending the new filter representation. */
old_fp = fp;
- fp = krealloc(old_fp, bpf_prog_size(new_len), GFP_KERNEL);
+ fp = bpf_prog_realloc(old_fp, bpf_prog_size(new_len), 0);
if (!fp) {
/* The old_fp is still around in case we couldn't
* allocate new memory, so uncharge on that one.
@@ -1013,7 +1013,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
if (fprog->filter == NULL)
return -EINVAL;
- fp = kmalloc(bpf_prog_size(fprog->len), GFP_KERNEL);
+ fp = bpf_prog_alloc(bpf_prog_size(fprog->len), 0);
if (!fp)
return -ENOMEM;
@@ -1069,7 +1069,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
if (fprog->filter == NULL)
return -EINVAL;
- prog = kmalloc(bpf_fsize, GFP_KERNEL);
+ prog = bpf_prog_alloc(bpf_fsize, 0);
if (!prog)
return -ENOMEM;
--
1.9.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox