* Re: [PATCH net-next] enic: set skb->hash type properly
From: David Miller @ 2016-11-02 19:33 UTC (permalink / raw)
To: gvaradar; +Cc: benve, netdev, _govind
In-Reply-To: <20161102005850.9904-1-gvaradar@cisco.com>
From: Govindarajulu Varadarajan <gvaradar@cisco.com>
Date: Tue, 1 Nov 2016 17:58:50 -0700
> From: Govindarajulu Varadarajan <_govind@gmx.com>
>
> Driver sets the skb l4/l3 hash based on NIC_CFG_RSS_HASH_TYPE_*,
> which is bit mask. This is wrong. Hw actually provides us enum.
> Use CQ_ENET_RQ_DESC_RSS_TYPE_* to set l3 and l4 hash type.
>
> Fixes: bf751ba802fe ("driver/net: enic: record q_number and rss_hash for skb")
> Signed-off-by: Govindarajulu Varadarajan <_govind@gmx.com>
Applied, thanks.
^ permalink raw reply
* RE: [PATCH v4 net-next] lan78xx: Use irq_domain for phy interrupt from USB Int. EP
From: Woojung.Huh @ 2016-11-02 19:31 UTC (permalink / raw)
To: davem; +Cc: netdev, f.fainelli, andrew, UNGLinuxDriver
In-Reply-To: <20161102.152441.459205528111412700.davem@davemloft.net>
> -----Original Message-----
> From: David Miller [mailto:davem@davemloft.net]
> Sent: Wednesday, November 02, 2016 3:25 PM
> To: Woojung Huh - C21699
> Cc: netdev@vger.kernel.org; f.fainelli@gmail.com; andrew@lunn.ch;
> UNGLinuxDriver
> Subject: Re: [PATCH v4 net-next] lan78xx: Use irq_domain for phy interrupt
> from USB Int. EP
>
> From: <Woojung.Huh@microchip.com>
> Date: Tue, 1 Nov 2016 20:02:00 +0000
>
> > From: Woojung Huh <woojung.huh@microchip.com>
> >
> > To utilize phylib with interrupt fully than handling some of phy stuff in the
> MAC driver,
> > create irq_domain for USB interrupt EP of phy interrupt and
> > pass the irq number to phy_connect_direct() instead of
> PHY_IGNORE_INTERRUPT.
> >
> > Idea comes from drivers/gpio/gpio-dl2.c
> >
> > Signed-off-by: Woojung Huh <woojung.huh@microchip.com>
>
> Applied.
Thanks!
^ permalink raw reply
* Re: [PATCH] net: 3com: typhoon: use new api ethtool_{get|set}_link_ksettings
From: David Miller @ 2016-11-02 19:27 UTC (permalink / raw)
To: tremyfr; +Cc: dave, netdev, linux-kernel
In-Reply-To: <1478041911-22188-1-git-send-email-tremyfr@gmail.com>
From: Philippe Reynes <tremyfr@gmail.com>
Date: Wed, 2 Nov 2016 00:11:51 +0100
> The ethtool api {get|set}_settings is deprecated.
> We move this driver to new api {get|set}_link_ksettings.
>
> Signed-off-by: Philippe Reynes <tremyfr@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next] ila: Fix crash caused by rhashtable changes
From: David Miller @ 2016-11-02 19:27 UTC (permalink / raw)
To: tom; +Cc: netdev, kernel-team
In-Reply-To: <20161101215525.360859-1-tom@herbertland.com>
From: Tom Herbert <tom@herbertland.com>
Date: Tue, 1 Nov 2016 14:55:25 -0700
> commit ca26893f05e86 ("rhashtable: Add rhlist interface")
> added a field to rhashtable_iter so that length became 56 bytes
> and would exceed the size of args in netlink_callback (which is
> 48 bytes). The netlink diag dump function already has been
> allocating a iter structure and storing the pointed to that
> in the args of netlink_callback. ila_xlat also uses
> rhahstable_iter but is still putting that directly in
> the arg block. Now since rhashtable_iter size is increased
> we are overwriting beyond the structure. The next field
> happens to be cb_mutex pointer in netlink_sock and hence the crash.
>
> Fix is to alloc the rhashtable_iter and save it as pointer
> in arg.
>
> Tested:
>
> modprobe ila
> ./ip ila add loc 3333:0:0:0 loc_match 2222:0:0:1,
> ./ip ila list # NO crash now
>
> Signed-off-by: Tom Herbert <tom@herbertland.com>
Applied.
^ permalink raw reply
* Re: [PATCH] net: ip, diag -- Adjust raw_abort to use unlocked __udp_disconnect
From: David Miller @ 2016-11-02 19:25 UTC (permalink / raw)
To: gorcunov
Cc: netdev, eric.dumazet, dsa, jhs, linux-kernel, kuznet, jmorris,
yoshfuji, kaber, avagin, stephen
In-Reply-To: <20161101200500.GA1852@uranus.lan>
From: Cyrill Gorcunov <gorcunov@gmail.com>
Date: Tue, 1 Nov 2016 23:05:00 +0300
> While being preparing patches for killing raw sockets via
> diag netlink interface I noticed that my runs are stuck:
>
> | [root@pcs7 ~]# cat /proc/`pidof ss`/stack
> | [<ffffffff816d1a76>] __lock_sock+0x80/0xc4
> | [<ffffffff816d206a>] lock_sock_nested+0x47/0x95
> | [<ffffffff8179ded6>] udp_disconnect+0x19/0x33
> | [<ffffffff8179b517>] raw_abort+0x33/0x42
> | [<ffffffff81702322>] sock_diag_destroy+0x4d/0x52
>
> which has not been the case before. I narrowed it down to the commit
>
> | commit 286c72deabaa240b7eebbd99496ed3324d69f3c0
> | Author: Eric Dumazet <edumazet@google.com>
> | Date: Thu Oct 20 09:39:40 2016 -0700
> |
> | udp: must lock the socket in udp_disconnect()
>
> where we start locking the socket for different reason.
>
> So the raw_abort escaped the renaming and we have to
> fix this typo using __udp_disconnect instead.
>
> CC: David S. Miller <davem@davemloft.net>
> CC: Eric Dumazet <eric.dumazet@gmail.com>
> CC: David Ahern <dsa@cumulusnetworks.com>
> CC: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
> CC: James Morris <jmorris@namei.org>
> CC: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
> CC: Patrick McHardy <kaber@trash.net>
> CC: Andrey Vagin <avagin@openvz.org>
> CC: Stephen Hemminger <stephen@networkplumber.org>
> Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Applied with proper Fixes: tag added.
^ permalink raw reply
* Re: [PATCH v4 net-next] lan78xx: Use irq_domain for phy interrupt from USB Int. EP
From: David Miller @ 2016-11-02 19:24 UTC (permalink / raw)
To: Woojung.Huh; +Cc: netdev, f.fainelli, andrew, UNGLinuxDriver
In-Reply-To: <9235D6609DB808459E95D78E17F2E43D4095D3D8@CHN-SV-EXMX02.mchp-main.com>
From: <Woojung.Huh@microchip.com>
Date: Tue, 1 Nov 2016 20:02:00 +0000
> From: Woojung Huh <woojung.huh@microchip.com>
>
> To utilize phylib with interrupt fully than handling some of phy stuff in the MAC driver,
> create irq_domain for USB interrupt EP of phy interrupt and
> pass the irq number to phy_connect_direct() instead of PHY_IGNORE_INTERRUPT.
>
> Idea comes from drivers/gpio/gpio-dl2.c
>
> Signed-off-by: Woojung Huh <woojung.huh@microchip.com>
Applied.
^ permalink raw reply
* Re: [PATCH net v3 2/2] ip6_udp_tunnel: remove unused IPCB related codes
From: David Miller @ 2016-11-02 19:19 UTC (permalink / raw)
To: elicooper; +Cc: netdev, shmulik.ladkani, tom
In-Reply-To: <20161101154513.30347-2-elicooper@gmx.com>
From: Eli Cooper <elicooper@gmx.com>
Date: Tue, 1 Nov 2016 23:45:13 +0800
> Some IPCB fields are currently set in udp_tunnel6_xmit_skb(), which are
> never used before it reaches ip6tunnel_xmit(), and past that point the
> control buffer is no longer interpreted as IPCB.
>
> This clears these unused IPCB related codes. Currently there is no skb
> scrubbing in ip6_udp_tunnel, otherwise IPCB(skb)->opt might need to be
> cleared for IPv4 packets, as shown in 5146d1f1511
> ("tunnel: Clear IPCB(skb)->opt before dst_link_failure called").
>
> Signed-off-by: Eli Cooper <elicooper@gmx.com>
Applied.
^ permalink raw reply
* Re: [PATCH net v3 1/2] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()
From: David Miller @ 2016-11-02 19:19 UTC (permalink / raw)
To: elicooper; +Cc: netdev, shmulik.ladkani, tom
In-Reply-To: <20161101154513.30347-1-elicooper@gmx.com>
From: Eli Cooper <elicooper@gmx.com>
Date: Tue, 1 Nov 2016 23:45:12 +0800
> skb->cb may contain data from previous layers. In the observed scenario,
> the garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so
> that small packets sent through the tunnel are mistakenly fragmented.
>
> This patch unconditionally clears the control buffer in ip6tunnel_xmit(),
> which affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of
> these tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Eli Cooper <elicooper@gmx.com>
> ---
> v3: moves to ip6tunnel_xmit() and clears IP6CB unconditionally
> v2: clears the whole IP6CB altogether and does it after encapsulation
Applied and queued up for -stable.
^ permalink raw reply
* Re: [PATCH 3/3] net: 3c509: use new api ethtool_{get|set}_link_ksettings
From: David Miller @ 2016-11-02 19:17 UTC (permalink / raw)
To: tremyfr; +Cc: klassert, mugunthanvnm, a, fw, jarod, fabf, netdev, linux-kernel
In-Reply-To: <1478014347-14994-3-git-send-email-tremyfr@gmail.com>
From: Philippe Reynes <tremyfr@gmail.com>
Date: Tue, 1 Nov 2016 16:32:27 +0100
> The ethtool api {get|set}_settings is deprecated.
> We move this driver to new api {get|set}_link_ksettings.
>
> Signed-off-by: Philippe Reynes <tremyfr@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH 2/3] net: 3c59x: use new api ethtool_{get|set}_link_ksettings
From: David Miller @ 2016-11-02 19:17 UTC (permalink / raw)
To: tremyfr; +Cc: klassert, mugunthanvnm, a, fw, jarod, fabf, netdev, linux-kernel
In-Reply-To: <1478014347-14994-2-git-send-email-tremyfr@gmail.com>
From: Philippe Reynes <tremyfr@gmail.com>
Date: Tue, 1 Nov 2016 16:32:26 +0100
> The ethtool api {get|set}_settings is deprecated.
> We move this driver to new api {get|set}_link_ksettings.
>
> Signed-off-by: Philippe Reynes <tremyfr@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH 1/3] net: mii: add generic function to support ksetting support
From: David Miller @ 2016-11-02 19:17 UTC (permalink / raw)
To: tremyfr; +Cc: klassert, mugunthanvnm, a, fw, jarod, fabf, netdev, linux-kernel
In-Reply-To: <1478014347-14994-1-git-send-email-tremyfr@gmail.com>
From: Philippe Reynes <tremyfr@gmail.com>
Date: Tue, 1 Nov 2016 16:32:25 +0100
> The old ethtool api (get_setting and set_setting) has generic mii
> functions mii_ethtool_sset and mii_ethtool_gset.
>
> To support the new ethtool api ({get|set}_link_ksettings), we add
> two generics mii function mii_ethtool_{get|set}_link_ksettings_get.
>
> Signed-off-by: Philippe Reynes <tremyfr@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next 0/3] tools lib bpf: Synchronize implementations
From: Arnaldo Carvalho de Melo @ 2016-11-02 19:12 UTC (permalink / raw)
To: David Miller; +Cc: alexei.starovoitov, joe, netdev, wangnan0, ast, daniel
In-Reply-To: <20161102.150405.1790701106774926472.davem@davemloft.net>
Em Wed, Nov 02, 2016 at 03:04:05PM -0400, David Miller escreveu:
> From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
> Date: Tue, 1 Nov 2016 16:04:35 -0600
>
> > I think these patches has to go through Arnaldo's perf tree, since
> > otherwise they will conflict with Wang's changes.
>
> Ok.
I'll look at it when back from Plumbers, maybe before.
- Arnaldo
^ permalink raw reply
* Re: [PATCH] MAINTAINERS: Update MELLANOX MLX5 core VPI driver maintainers
From: David Miller @ 2016-11-02 19:10 UTC (permalink / raw)
To: saeedm; +Cc: netdev, ogerlitz, leonro, matanb
In-Reply-To: <1478005798-6473-1-git-send-email-saeedm@mellanox.com>
From: Saeed Mahameed <saeedm@mellanox.com>
Date: Tue, 1 Nov 2016 15:09:58 +0200
> Add myself as a maintainer for mlx5 core driver as well.
>
> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Applied.
^ permalink raw reply
* [PATCH] net: tcp: check skb is non-NULL for exact match on lookups
From: David Ahern @ 2016-11-02 19:08 UTC (permalink / raw)
To: netdev; +Cc: andreyknvl, David Ahern
Andrey reported the following error report while running the syzkaller
fuzzer:
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 648 Comm: syz-executor Not tainted 4.9.0-rc3+ #333
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8800398c4480 task.stack: ffff88003b468000
RIP: 0010:[<ffffffff83091106>] [< inline >]
inet_exact_dif_match include/net/tcp.h:808
RIP: 0010:[<ffffffff83091106>] [<ffffffff83091106>]
__inet_lookup_listener+0xb6/0x500 net/ipv4/inet_hashtables.c:219
RSP: 0018:ffff88003b46f270 EFLAGS: 00010202
RAX: 0000000000000004 RBX: 0000000000004242 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffc90000e3c000 RDI: 0000000000000054
RBP: ffff88003b46f2d8 R08: 0000000000004000 R09: ffffffff830910e7
R10: 0000000000000000 R11: 000000000000000a R12: ffffffff867fa0c0
R13: 0000000000004242 R14: 0000000000000003 R15: dffffc0000000000
FS: 00007fb135881700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020cc3000 CR3: 000000006d56a000 CR4: 00000000000006f0
Stack:
0000000000000000 000000000601a8c0 0000000000000000 ffffffff00004242
424200003b9083c2 ffff88003def4041 ffffffff84e7e040 0000000000000246
ffff88003a0911c0 0000000000000000 ffff88003a091298 ffff88003b9083ae
Call Trace:
[<ffffffff831100f4>] tcp_v4_send_reset+0x584/0x1700 net/ipv4/tcp_ipv4.c:643
[<ffffffff83115b1b>] tcp_v4_rcv+0x198b/0x2e50 net/ipv4/tcp_ipv4.c:1718
[<ffffffff83069d22>] ip_local_deliver_finish+0x332/0xad0
net/ipv4/ip_input.c:216
...
MD5 has a code path that calls __inet_lookup_listener with a null skb,
so inet{6}_exact_dif_match needs to check skb against null before pulling
the flag.
Fixes: a04a480d4392 ("net: Require exact match for TCP socket lookups if
dif is l3mdev")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
---
Dave: commit a04a480d4392 was queued for stable, so this needs to follow it.
include/linux/ipv6.h | 2 +-
include/net/tcp.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index ca1ad9ebbc92..a0649973ee5b 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -149,7 +149,7 @@ static inline bool inet6_exact_dif_match(struct net *net, struct sk_buff *skb)
{
#if defined(CONFIG_NET_L3_MASTER_DEV)
if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
- ipv6_l3mdev_skb(IP6CB(skb)->flags))
+ skb && ipv6_l3mdev_skb(IP6CB(skb)->flags))
return true;
#endif
return false;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 5b82d4d94834..304a8e17bc87 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -805,7 +805,7 @@ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
{
#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
- ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
+ skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
return true;
#endif
return false;
--
2.1.4
^ permalink raw reply related
* Re: [PATCH net-next V3 0/3] mlx4 XDP TX refactor
From: David Miller @ 2016-11-02 19:07 UTC (permalink / raw)
To: tariqt; +Cc: netdev, eranbe, bblanco, alexei.starovoitov, saeedm
In-Reply-To: <1478099545-24181-1-git-send-email-tariqt@mellanox.com>
From: Tariq Toukan <tariqt@mellanox.com>
Date: Wed, 2 Nov 2016 17:12:22 +0200
> This patchset refactors the XDP forwarding case, so that
> its dedicated transmit queues are managed in a complete
> separation from the other regular ones.
>
> It also adds ethtool counters for XDP cases.
>
> Series generated against net-next commit:
> 22ca904ad70a genetlink: fix error return code in genl_register_family()
...
> v3:
> * Exposed per ring counters.
>
> v2:
> * Added ethtool counters.
> * Rebased, now patch 2 reverts Brenden's fix, as the bug no longer exists:
> 958b3d396d7f ("net/mlx4_en: fixup xdp tx irq to match rx")
> * Updated commit message of patch 2.
Series applied, thanks.
^ permalink raw reply
* Re: [PATCH net-next 0/3] tools lib bpf: Synchronize implementations
From: David Miller @ 2016-11-02 19:04 UTC (permalink / raw)
To: alexei.starovoitov; +Cc: joe, netdev, wangnan0, ast, daniel, acme
In-Reply-To: <CAADnVQ+u5Q=+275nQCeHN2grk+kmRke9uJmMjRarA92UG7uGsA@mail.gmail.com>
From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date: Tue, 1 Nov 2016 16:04:35 -0600
> I think these patches has to go through Arnaldo's perf tree, since
> otherwise they will conflict with Wang's changes.
Ok.
^ permalink raw reply
* Re: [PATCH net-next] sctp: clean up sctp_packet_transmit
From: David Miller @ 2016-11-02 19:03 UTC (permalink / raw)
To: lucien.xin; +Cc: netdev, linux-sctp, marcelo.leitner, nhorman, vyasevich
In-Reply-To: <407056b761e77ecbd43603a17099bb9309a9a8ac.1477932581.git.lucien.xin@gmail.com>
From: Xin Long <lucien.xin@gmail.com>
Date: Tue, 1 Nov 2016 00:49:41 +0800
> After adding sctp gso, sctp_packet_transmit is a quite big function now.
>
> This patch is to extract the codes for packing packet to sctp_packet_pack
> from sctp_packet_transmit, and add some comments, simplify the err path by
> freeing auth chunk when freeing packet chunk_list in out path and freeing
> head skb early if it fails to pack packet.
>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next 0/2] misc TC/flower changes
From: David Miller @ 2016-11-02 19:01 UTC (permalink / raw)
To: roid; +Cc: netdev, jiri
In-Reply-To: <1478009309-63180-1-git-send-email-roid@mellanox.com>
From: Roi Dayan <roid@mellanox.com>
Date: Tue, 1 Nov 2016 16:08:27 +0200
> This series includes two small changes to the TC flower classifier.
Series applied, thanks!
^ permalink raw reply
* Re: [PATCH 00/12] Netfilter updates for net-next
From: David Miller @ 2016-11-02 18:59 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
In-Reply-To: <1478035593-1362-1-git-send-email-pablo@netfilter.org>
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 1 Nov 2016 22:26:21 +0100
> The following patchset contains Netfilter updates for your net-next
> tree. This includes better integration with the routing subsystem for
> nf_tables, explicit notrack support and smaller updates. More
> specifically, they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
The nft fib module looks really cool.
Pulled, thanks Pablo.
^ permalink raw reply
* net/dccp: null-ptr-deref in dccp_v4_rcv/selinux_socket_sock_rcv_skb
From: Andrey Konovalov @ 2016-11-02 18:44 UTC (permalink / raw)
To: Gerrit Renker, David S. Miller, dccp, netdev, LKML
Cc: Dmitry Vyukov, Alexander Potapenko, Kostya Serebryany,
Eric Dumazet, syzkaller
Hi,
I've got the following error report while running the syzkaller fuzzer:
IPv4: Attempt to release alive inet socket ffff880068e98940
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 1 PID: 3905 Comm: a.out Not tainted 4.9.0-rc3+ #333
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006b9e0000 task.stack: ffff880068770000
RIP: 0010:[<ffffffff819ead5f>] [<ffffffff819ead5f>]
selinux_socket_sock_rcv_skb+0xff/0x6a0 security/selinux/hooks.c:4639
RSP: 0018:ffff8800687771c8 EFLAGS: 00010202
RAX: ffff88006b9e0000 RBX: 1ffff1000d0eee3f RCX: 1ffff1000d1d312a
RDX: 1ffff1000d1d31a6 RSI: dffffc0000000000 RDI: 0000000000000010
RBP: ffff880068777360 R08: 0000000000000000 R09: 0000000000000002
R10: dffffc0000000000 R11: 0000000000000006 R12: ffff880068e98940
R13: 0000000000000002 R14: ffff880068777338 R15: 0000000000000000
FS: 00007f00ff760700(0000) GS:ffff88006cd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020008000 CR3: 000000006a308000 CR4: 00000000000006e0
Stack:
ffff8800687771e0 ffffffff812508a5 ffff8800686f3168 0000000000000007
ffff88006ac8cdfc ffff8800665ea500 0000000041b58ab3 ffffffff847b5480
ffffffff819eac60 ffff88006b9e0860 ffff88006b9e0868 ffff88006b9e07f0
Call Trace:
[<ffffffff819c8dd5>] security_sock_rcv_skb+0x75/0xb0 security/security.c:1317
[<ffffffff82c2a9e7>] sk_filter_trim_cap+0x67/0x10e0 net/core/filter.c:81
[<ffffffff82b81e60>] __sk_receive_skb+0x30/0xa00 net/core/sock.c:460
[<ffffffff838bbf12>] dccp_v4_rcv+0xdb2/0x1910 net/dccp/ipv4.c:873
[<ffffffff83069d22>] ip_local_deliver_finish+0x332/0xad0
net/ipv4/ip_input.c:216
[< inline >] NF_HOOK_THRESH ./include/linux/netfilter.h:232
[< inline >] NF_HOOK ./include/linux/netfilter.h:255
[<ffffffff8306abd2>] ip_local_deliver+0x1c2/0x4b0 net/ipv4/ip_input.c:257
[< inline >] dst_input ./include/net/dst.h:507
[<ffffffff83068500>] ip_rcv_finish+0x750/0x1c40 net/ipv4/ip_input.c:396
[< inline >] NF_HOOK_THRESH ./include/linux/netfilter.h:232
[< inline >] NF_HOOK ./include/linux/netfilter.h:255
[<ffffffff8306b82f>] ip_rcv+0x96f/0x12f0 net/ipv4/ip_input.c:487
[<ffffffff82bd9fb7>] __netif_receive_skb_core+0x1897/0x2a50 net/core/dev.c:4213
[<ffffffff82bdb19a>] __netif_receive_skb+0x2a/0x170 net/core/dev.c:4251
[<ffffffff82bdb493>] netif_receive_skb_internal+0x1b3/0x390 net/core/dev.c:4279
[<ffffffff82bdb6b8>] netif_receive_skb+0x48/0x250 net/core/dev.c:4303
[<ffffffff8241fc75>] tun_get_user+0xbd5/0x28a0 drivers/net/tun.c:1308
[<ffffffff82421b5a>] tun_chr_write_iter+0xda/0x190 drivers/net/tun.c:1332
[< inline >] new_sync_write fs/read_write.c:499
[<ffffffff8151bd44>] __vfs_write+0x334/0x570 fs/read_write.c:512
[<ffffffff8151f85b>] vfs_write+0x17b/0x500 fs/read_write.c:560
[< inline >] SYSC_write fs/read_write.c:607
[<ffffffff81523184>] SyS_write+0xd4/0x1a0 fs/read_write.c:599
[<ffffffff83fc02c1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
arch/x86/entry/entry_64.S:209
Code: 31 45 84 c0 74 0a 41 80 f8 01 0f 8e 26 04 00 00 49 8d 7f 10 49
ba 00 00 00 00 00 fc ff df 45 0f b7 6c 24 10 49 89 f9 49 c1 e9 03 <47>
0f b6 1c 11 45 84 db 74 0a 41 80 fb 03 0f 8e 01 04 00 00 41
RIP [<ffffffff819ead5f>] selinux_socket_sock_rcv_skb+0xff/0x6a0
security/selinux/hooks.c:4639
RSP <ffff8800687771c8>
---[ end trace 6c39677dc406a11b ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
---[ end Kernel panic - not syncing: Fatal exception in interrupt
On commit 0c183d92b20b5c84ca655b45ef57b3318b83eb9e (Oct 31).
Thanks!
^ permalink raw reply
* Re: [PATCH v5 3/7] net: phy: broadcom: Add BCM54810 PHY entry
From: Andrew Lunn @ 2016-11-02 18:37 UTC (permalink / raw)
To: Jon Mason
Cc: David Miller, Rob Herring, Mark Rutland, Florian Fainelli,
devicetree, netdev, linux-kernel, bcm-kernel-feedback-list, rafal,
linux-arm-kernel
In-Reply-To: <1478106488-11779-4-git-send-email-jon.mason@broadcom.com>
On Wed, Nov 02, 2016 at 01:08:04PM -0400, Jon Mason wrote:
> The BCM54810 PHY requires some semi-unique configuration, which results
> in some additional configuration in addition to the standard config.
> Also, some users of the BCM54810 require the PHY lanes to be swapped.
> Since there is no way to detect this, add a device tree query to see if
> it is applicable.
>
> Inspired-by: Vikas Soni <vsoni@broadcom.com>
> Signed-off-by: Jon Mason <jon.mason@broadcom.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply
* Re: net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match
From: Andrey Konovalov @ 2016-11-02 18:36 UTC (permalink / raw)
To: David Ahern
Cc: Eric Dumazet, David S. Miller, Alexey Kuznetsov, James Morris,
Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Dmitry Vyukov,
Alexander Potapenko, Kostya Serebryany, Eric Dumazet, syzkaller
In-Reply-To: <f92b8a3e-9318-90c4-009a-15da3897ff6b@cumulusnetworks.com>
Hi David,
I'm able to reproduce it, so I'd be happy to test your fix.
Thanks!
On Wed, Nov 2, 2016 at 7:31 PM, David Ahern <dsa@cumulusnetworks.com> wrote:
> On 11/2/16 11:21 AM, Eric Dumazet wrote:
>> Thanks for your report.
>>
>> David, please take a look.
>>
>> TCP MD5 can call __inet_lookup_listener() with a NULL skb.
>
> interesting. I did not test md5 before sending, but doing so now I am not able to trigger the panic with any combination of passwords - correct, wrong, none, no listener, etc. perhaps I am missing a sysctl setting.
>
> Will send a fix. I see the call to __inet_lookup_listener with null skb.
>
>>
>> Bug added in commit a04a480d4392ea6efd117be2de564117b2a009c0
>
^ permalink raw reply
* Re: net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match
From: David Ahern @ 2016-11-02 18:31 UTC (permalink / raw)
To: Eric Dumazet, Andrey Konovalov
Cc: David S. Miller, Alexey Kuznetsov, James Morris,
Hideaki YOSHIFUJI, Patrick McHardy, netdev, LKML, Dmitry Vyukov,
Alexander Potapenko, Kostya Serebryany, Eric Dumazet, syzkaller
In-Reply-To: <1478107305.7065.382.camel@edumazet-glaptop3.roam.corp.google.com>
On 11/2/16 11:21 AM, Eric Dumazet wrote:
> Thanks for your report.
>
> David, please take a look.
>
> TCP MD5 can call __inet_lookup_listener() with a NULL skb.
interesting. I did not test md5 before sending, but doing so now I am not able to trigger the panic with any combination of passwords - correct, wrong, none, no listener, etc. perhaps I am missing a sysctl setting.
Will send a fix. I see the call to __inet_lookup_listener with null skb.
>
> Bug added in commit a04a480d4392ea6efd117be2de564117b2a009c0
^ permalink raw reply
* Re: [PATCH net] r8152: Fix broken RX checksums.
From: Mark Lord @ 2016-11-02 18:29 UTC (permalink / raw)
To: Hayes Wang, David Miller
Cc: nic_swsd, netdev@vger.kernel.org, linux-kernel@vger.kernel.org
In-Reply-To: <0835B3720019904CB8F7AA43166CEEB201047353@RTITMBSV03.realtek.com.tw>
On 16-10-31 04:14 AM, Hayes Wang wrote:
>>>>> The r8152 driver has been broken since (approx) 3.16.xx
>>>>> when support was added for hardware RX checksums
>>>>> on newer chip versions. Symptoms include random
>>>>> segfaults and silent data corruption over NFS.
>>>>>
>>>>> The hardware checksum logig does not work on the VER_02
>>>>> dongles I have here when used with a slow embedded system CPU.
>>>>> Google reveals others reporting similar issues on Raspberry Pi.
...
> Our hw engineer says only VER_01 has the issue about rx checksum.
> I need more information for checking it.
I have poked at it some more, and thus far it appears that it is
only necessary to disable TCP rx checksums. The system doesn't crash
when only IP/UDP checksums are enabled, but does when TCP checksums are on.
This happens regardless of whether RX_AGG is disabled or enabled,
and increasing/decreasing the number of RX URBs (RTL8152_MAX_RX)
doesn't seem to affect it.
lsusb -vv (from an x86 system, not the failing embedded system) follows:
Bus 001 Device 004: ID 0bda:8152 Realtek Semiconductor Corp.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.10
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0bda Realtek Semiconductor Corp.
idProduct 0x8152
bcdDevice 20.00
iManufacturer 1 Realtek
iProduct 2 USB 10/100 LAN
iSerial 3 84E71400257D
bNumConfigurations 2
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 39
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0002 1x 2 bytes
bInterval 8
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 80
bNumInterfaces 2
bConfigurationValue 2
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 6 Ethernet Networking
bInterfaceProtocol 0
iInterface 5 CDC Communications Control
CDC Header:
bcdCDC 1.10
CDC Union:
bMasterInterface 0
bSlaveInterface 1
CDC Ethernet:
iMacAddress 3 84E71400257D
bmEthernetStatistics 0x00000000
wMaxSegmentSize 1514
wNumberMCFilters 0x0000
bNumberPowerFilters 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0010 1x 16 bytes
bInterval 8
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 1
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 Unused
bInterfaceProtocol 0
iInterface 4 Ethernet Data
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Binary Object Store Descriptor:
bLength 5
bDescriptorType 15
wTotalLength 12
bNumDeviceCaps 1
USB 2.0 Extension Device Capability:
bLength 7
bDescriptorType 16
bDevCapabilityType 2
bmAttributes 0x00000002
Link Power Management (LPM) Supported
Device Status: 0x0000
(Bus Powered)
^ permalink raw reply
* Re: [PATCH v5 2/7] Documentation: devicetree: add PHY lane swap binding
From: Andrew Lunn @ 2016-11-02 17:39 UTC (permalink / raw)
To: Jon Mason
Cc: David Miller, Rob Herring, Mark Rutland, Florian Fainelli,
devicetree, netdev, linux-kernel, bcm-kernel-feedback-list, rafal,
linux-arm-kernel
In-Reply-To: <1478106488-11779-3-git-send-email-jon.mason@broadcom.com>
On Wed, Nov 02, 2016 at 01:08:03PM -0400, Jon Mason wrote:
> Add the documentation for PHY lane swapping. This is a boolean entry to
> notify the phy device drivers that the TX/RX lanes need to be swapped.
>
> Signed-off-by: Jon Mason <jon.mason@broadcom.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox