* Re: [PATCH 1/2] dt-bindings: add sff,sff binding for SFP support
From: Rob Herring @ 2017-12-14 19:07 UTC (permalink / raw)
To: Russell King
Cc: Andrew Lunn, Florian Fainelli,
devicetree-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Mark Rutland,
netdev
In-Reply-To: <E1ePQju-0003ps-QW-eh5Bv4kxaXIk46pC+1QYvQNdhmdF6hFW@public.gmane.org>
On Thu, Dec 14, 2017 at 4:27 AM, Russell King
<rmk+kernel-I+IVW8TIWO2tmTQ+vhA3Yw@public.gmane.org> wrote:
> Add "sff,sff" for SFF module support with SFP. These have a different
> phys_id value, and also have the present and rate select signals omitted
> compared with their socketed counter-parts.
>
> Signed-off-by: Russell King <rmk+kernel-I+IVW8TIWO2tmTQ+vhA3Yw@public.gmane.org>
> ---
> Documentation/devicetree/bindings/net/sff,sfp.txt | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
Reviewed-by: Rob Herring <robh-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: KASAN: use-after-free Read in refcount_inc_not_zero
From: Cong Wang @ 2017-12-14 19:07 UTC (permalink / raw)
To: syzbot
Cc: Andrew Morton, alexander.deucher, broonie, chris, David Miller,
deepa.kernel, Greg KH, gscrivan, LKML, linux-sctp,
luc.vanoostenryck, lucien xin, Ingo Molnar,
Linux Kernel Network Developers, Neil Horman, syzkaller-bugs,
Al Viro, Vladislav Yasevich
In-Reply-To: <089e082bdf1062d5ed056050f926@google.com>
On Thu, Dec 14, 2017 at 10:23 AM, syzbot
<bot+9e3011b5e961675e736b38d6fd82ad12723a3fa3@syzkaller.appspotmail.com>
wrote:
> syzkaller has found reproducer for the following crash on
> 82bcf1def3b5f1251177ad47c44f7e17af039b4b
> git://git.cmpxchg.org/linux-mmots.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> C reproducer is attached
> syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> for information about syzkaller reproducers
>
>
> ==================================================================
> BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183
> [inline]
> BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:27
> [inline]
> BUG: KASAN: use-after-free in refcount_inc_not_zero+0x16e/0x180
> lib/refcount.c:120
> Read of size 4 at addr ffff8801c51bb200 by task syzkaller711981/3156
>
> CPU: 1 PID: 3156 Comm: syzkaller711981 Not tainted 4.15.0-rc2-mm1+ #39
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:17 [inline]
> dump_stack+0x194/0x257 lib/dump_stack.c:53
> print_address_description+0x73/0x250 mm/kasan/report.c:252
> kasan_report_error mm/kasan/report.c:351 [inline]
> kasan_report+0x25b/0x340 mm/kasan/report.c:409
> __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
> __read_once_size include/linux/compiler.h:183 [inline]
> atomic_read arch/x86/include/asm/atomic.h:27 [inline]
> refcount_inc_not_zero+0x16e/0x180 lib/refcount.c:120
> refcount_inc+0x15/0x50 lib/refcount.c:153
> get_ipc_ns include/linux/ipc_namespace.h:129 [inline]
> __get_ns_from_inode ipc/mqueue.c:110 [inline]
> get_ns_from_inode ipc/mqueue.c:118 [inline]
> mqueue_evict_inode+0x137/0x9c0 ipc/mqueue.c:402
> evict+0x481/0x920 fs/inode.c:552
> iput_final fs/inode.c:1514 [inline]
> iput+0x7b9/0xaf0 fs/inode.c:1541
> dentry_unlink_inode+0x4b0/0x5e0 fs/dcache.c:376
> __dentry_kill+0x3b7/0x6d0 fs/dcache.c:573
> shrink_dentry_list+0x3c5/0xcf0 fs/dcache.c:1020
> shrink_dcache_parent+0xba/0x230 fs/dcache.c:1454
> do_one_tree+0x15/0x50 fs/dcache.c:1485
> shrink_dcache_for_umount+0xbb/0x290 fs/dcache.c:1502
> generic_shutdown_super+0xcd/0x540 fs/super.c:424
> kill_anon_super fs/super.c:987 [inline]
> kill_litter_super+0x72/0x90 fs/super.c:997
> deactivate_locked_super+0x88/0xd0 fs/super.c:312
> deactivate_super+0x141/0x1b0 fs/super.c:343
> cleanup_mnt+0xb2/0x150 fs/namespace.c:1173
> __cleanup_mnt+0x16/0x20 fs/namespace.c:1180
> task_work_run+0x199/0x270 kernel/task_work.c:113
> exit_task_work include/linux/task_work.h:22 [inline]
Seems we can simply fix it by swapping exit_task_work()
with exit_task_namespaces() in do_exit()...
> do_exit+0x9bb/0x1ae0 kernel/exit.c:869
> do_group_exit+0x149/0x400 kernel/exit.c:972
> SYSC_exit_group kernel/exit.c:983 [inline]
> SyS_exit_group+0x1d/0x20 kernel/exit.c:981
> entry_SYSCALL_64_fastpath+0x1f/0x96
> RIP: 0033:0x440729
> RSP: 002b:00007ffd090ef228 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
> RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 0000000000440729
> RDX: 0000000000440729 RSI: 0000000000000000 RDI: 0000000000000001
> RBP: 00000000006cb018 R08: 0000000000000000 R09: 00000000004002c8
> R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000401bf0
> R13: 0000000000401c80 R14: 0000000000000000 R15: 0000000000000000
>
> Allocated by task 3156:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:447
> set_track mm/kasan/kasan.c:459 [inline]
> kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
> kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3614
> kmalloc include/linux/slab.h:516 [inline]
> create_ipc_ns ipc/namespace.c:45 [inline]
> copy_ipcs+0x1b3/0x520 ipc/namespace.c:96
> create_new_namespaces+0x278/0x880 kernel/nsproxy.c:87
> unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206
> SYSC_unshare kernel/fork.c:2421 [inline]
> SyS_unshare+0x653/0xfa0 kernel/fork.c:2371
> entry_SYSCALL_64_fastpath+0x1f/0x96
>
> Freed by task 3156:
> save_stack+0x43/0xd0 mm/kasan/kasan.c:447
> set_track mm/kasan/kasan.c:459 [inline]
> kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524
> __cache_free mm/slab.c:3492 [inline]
> kfree+0xca/0x250 mm/slab.c:3807
> free_ipc_ns ipc/namespace.c:139 [inline]
> put_ipc_ns+0x112/0x150 ipc/namespace.c:164
> free_nsproxy+0xc0/0x1f0 kernel/nsproxy.c:180
> switch_task_namespaces+0x9d/0xc0 kernel/nsproxy.c:229
> exit_task_namespaces+0x17/0x20 kernel/nsproxy.c:234
> do_exit+0x9b6/0x1ae0 kernel/exit.c:868
> do_group_exit+0x149/0x400 kernel/exit.c:972
> SYSC_exit_group kernel/exit.c:983 [inline]
> SyS_exit_group+0x1d/0x20 kernel/exit.c:981
> entry_SYSCALL_64_fastpath+0x1f/0x96
>
> The buggy address belongs to the object at ffff8801c51bb200
> which belongs to the cache kmalloc-2048 of size 2048
> The buggy address is located 0 bytes inside of
> 2048-byte region [ffff8801c51bb200, ffff8801c51bba00)
> The buggy address belongs to the page:
> page:000000007764ba6d count:1 mapcount:0 mapping:000000002c36623f index:0x0
> compound_mapcount: 0
> flags: 0x2fffc0000008100(slab|head)
> raw: 02fffc0000008100 ffff8801c51ba100 0000000000000000 0000000100000003
> raw: ffffea000715d320 ffff8801dac01950 ffff8801dac00c40 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
> ffff8801c51bb100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8801c51bb180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>
>> ffff8801c51bb200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>
> ^
> ffff8801c51bb280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c51bb300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
>
^ permalink raw reply
* Re: [PATCH 1/2] dt-bindings: add sff,sff binding for SFP support
From: Florian Fainelli @ 2017-12-14 19:11 UTC (permalink / raw)
To: Russell King, Andrew Lunn, Rob Herring
Cc: devicetree-u79uwXL29TY76Z2rM5mHXA, Mark Rutland,
netdev-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <E1ePQju-0003ps-QW-eh5Bv4kxaXIk46pC+1QYvQNdhmdF6hFW@public.gmane.org>
On 12/14/2017 02:27 AM, Russell King wrote:
> Add "sff,sff" for SFF module support with SFP. These have a different
> phys_id value, and also have the present and rate select signals omitted
> compared with their socketed counter-parts.
>
> Signed-off-by: Russell King <rmk+kernel-I+IVW8TIWO2tmTQ+vhA3Yw@public.gmane.org>
Reviewed-by: Florian Fainelli <f.fainelli-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
--
Florian
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH v3 1/3] Revert "ethtool: Add DMA Coalescing support"
From: John W. Linville @ 2017-12-14 19:03 UTC (permalink / raw)
To: Scott Branden
Cc: BCM Kernel Feedback, Steve Lin, Michael Chan, netdev,
Paul Greenwalt, Stephen Hemminger
In-Reply-To: <1513110003-10543-2-git-send-email-scott.branden@broadcom.com>
Applied.
On Tue, Dec 12, 2017 at 12:20:01PM -0800, Scott Branden wrote:
> This reverts commit 5dd7bfbc5079cb375876e4e76191263fc28ae1a6.
>
> As Stephen Hemminger mentioned
> there is an ABI compatibility issue with this patch:
>
> https://patchwork.ozlabs.org/patch/806049/#1757846
> Signed-off-by: Scott Branden <scott.branden@broadcom.com>
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
^ permalink raw reply
* Re: [PATCH 2/2] sfp: add sff module support
From: Florian Fainelli @ 2017-12-14 19:16 UTC (permalink / raw)
To: Russell King, Andrew Lunn, Rob Herring; +Cc: devicetree, Mark Rutland, netdev
In-Reply-To: <E1ePQjz-0003q6-Tf@rmk-PC.armlinux.org.uk>
On 12/14/2017 02:27 AM, Russell King wrote:
> Add support for SFF modules, which are soldered down SFP modules.
> These have a different phys_id value, and also have the present and
> rate select signals omitted compared with their socketed counter-parts.
>
> Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Thanks!
--
Florian
^ permalink raw reply
* Re: [patch net-next v3 05/10] net: sched: keep track of offloaded filters and check tc offload feature
From: Jakub Kicinski @ 2017-12-14 19:22 UTC (permalink / raw)
To: Jiri Pirko
Cc: netdev, davem, jhs, xiyou.wangcong, mlxsw, andrew, vivien.didelot,
f.fainelli, michael.chan, ganeshgr, saeedm, matanb, leonro,
idosch, simon.horman, pieter.jansenvanvuuren, john.hurley,
alexander.h.duyck, ogerlitz, john.fastabend, daniel
In-Reply-To: <20171213151038.29665-6-jiri@resnulli.us>
On Wed, 13 Dec 2017 16:10:33 +0100, Jiri Pirko wrote:
> diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
> index 69d7e9a..9cf61e7 100644
> --- a/net/sched/cls_bpf.c
> +++ b/net/sched/cls_bpf.c
> @@ -170,8 +170,10 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
> cls_bpf_offload_cmd(tp, prog, TC_CLSBPF_DESTROY);
> return err;
> } else if (err > 0) {
> - prog->gen_flags |= TCA_CLS_FLAGS_IN_HW;
> + tcf_block_offload_inc(block, &prog->gen_flags);
> }
> + } else {
> + tcf_block_offload_dec(block, &prog->gen_flags);
> }
>
> if (addorrep && skip_sw && !(prog->gen_flags & TCA_CLS_FLAGS_IN_HW))
The in_hw reporting also seems broken.
tools/testing/selftests/bpf/test_offload.py catches this.
^ permalink raw reply
* [PATCH iproute2 1/1] ss: add missing path MTU parameter
From: Roman Mashak @ 2017-12-14 19:23 UTC (permalink / raw)
To: stephen; +Cc: netdev, jhs, Roman Mashak
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
---
man/man8/ss.8 | 4 ++++
misc/ss.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/man/man8/ss.8 b/man/man8/ss.8
index 6d06383..0d52673 100644
--- a/man/man8/ss.8
+++ b/man/man8/ss.8
@@ -184,6 +184,10 @@ max segment size
congestion window size
.P
.TP
+.B pmtu:<pmtu>
+path MTU value
+.P
+.TP
.B ssthresh:<ssthresh>
tcp congestion window slow start threshold
.P
diff --git a/misc/ss.c b/misc/ss.c
index da52d5e..b93f6cc 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -727,6 +727,7 @@ struct tcpstat {
int mss;
int rcv_mss;
int advmss;
+ unsigned int pmtu;
unsigned int cwnd;
unsigned int lastsnd;
unsigned int lastrcv;
@@ -1967,6 +1968,8 @@ static void tcp_stats_print(struct tcpstat *s)
printf(" cwnd:%u", s->cwnd);
if (s->ssthresh)
printf(" ssthresh:%d", s->ssthresh);
+ if (s->pmtu)
+ printf(" pmtu:%u", s->pmtu);
if (s->bytes_acked)
printf(" bytes_acked:%llu", s->bytes_acked);
@@ -2308,6 +2311,7 @@ static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
s.reordering = info->tcpi_reordering;
s.rcv_ssthresh = info->tcpi_rcv_ssthresh;
s.cwnd = info->tcpi_snd_cwnd;
+ s.pmtu = info->tcpi_pmtu;
if (info->tcpi_snd_ssthresh < 0xFFFF)
s.ssthresh = info->tcpi_snd_ssthresh;
--
2.7.4
^ permalink raw reply related
* Re: [PATCH v3 2/3] ethtool-copy.h: sync with net-next
From: John W. Linville @ 2017-12-14 19:23 UTC (permalink / raw)
To: Scott Branden
Cc: BCM Kernel Feedback, Steve Lin, Michael Chan, netdev,
Paul Greenwalt, Stephen Hemminger
In-Reply-To: <1513110003-10543-3-git-send-email-scott.branden@broadcom.com>
Applied.
On Tue, Dec 12, 2017 at 12:20:02PM -0800, Scott Branden wrote:
> This covers kernel changes up to:
>
> commit 40e44a1e669d078946f46853808a60d29e6f0885
> Author: Scott Branden <scott.branden@broadcom.com>
> Date: Thu Nov 30 11:35:59 2017 -0800
>
> net: ethtool: add support for reset of AP inside NIC interface.
>
> Add ETH_RESET_AP to reset the application processor(s) inside the NIC
> interface.
>
> Current ETH_RESET_MGMT supports a management processor inside this NIC.
> This is typically used for remote NIC management purposes.
>
> Application processors exist inside some SmartNICs to run various
> applications inside the NIC processor - be it a simple algorithm without
> an OS to as complex as hosting multiple VMs.
>
> Signed-off-by: Scott Branden <scott.branden@broadcom.com>
> Reviewed-by: Andrew Lunn <andrew@lunn.ch>
> Signed-off-by: David S. Miller <davem@davemloft.net>
>
> Signed-off-by: Scott Branden <scott.branden@broadcom.com>
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
^ permalink raw reply
* Re: [PATCH v3 3/3] ethtool: Add ETHTOOL_RESET support via --reset command
From: John W. Linville @ 2017-12-14 19:23 UTC (permalink / raw)
To: Scott Branden
Cc: BCM Kernel Feedback, Steve Lin, Michael Chan, netdev,
Paul Greenwalt, Stephen Hemminger
In-Reply-To: <1513110003-10543-4-git-send-email-scott.branden@broadcom.com>
Applied.
On Tue, Dec 12, 2017 at 12:20:03PM -0800, Scott Branden wrote:
> Add ETHTOOL_RESET support via --reset command.
>
> ie. ethtool --reset DEVNAME <flagname(s)>
>
> flagnames currently match the ETH_RESET_xxx names:
> mgmt,irq,dma,filter,offload,mac,phy,ram,ap,dedicated,all
>
> Add -shared onto end of components to specified shared version.
>
> Alternatively, you can specific component bitfield directly using
> ethtool --reset DEVNAME flags %x
>
> Signed-off-by: Scott Branden <scott.branden@broadcom.com>
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
^ permalink raw reply
* Re: [PATCH iproute2 1/1] ss: add missing path MTU parameter
From: Neal Cardwell @ 2017-12-14 19:32 UTC (permalink / raw)
To: Roman Mashak; +Cc: Stephen Hemminger, Netdev, Jamal Hadi Salim
In-Reply-To: <1513279438-15045-1-git-send-email-mrv@mojatatu.com>
On Thu, Dec 14, 2017 at 2:23 PM, Roman Mashak <mrv@mojatatu.com> wrote:
>
> Signed-off-by: Roman Mashak <mrv@mojatatu.com>
> ---
...
> @@ -1967,6 +1968,8 @@ static void tcp_stats_print(struct tcpstat *s)
> printf(" cwnd:%u", s->cwnd);
> if (s->ssthresh)
> printf(" ssthresh:%d", s->ssthresh);
> + if (s->pmtu)
> + printf(" pmtu:%u", s->pmtu);
Would it be possible to print the pmtu immediately after the mss? IMHO
having related parameters next to each other this way would make this
easier to parse for humans.
Thanks for adding this!
cheers,
neal
^ permalink raw reply
* Re: [PATCHv2 net-next 02/15] lib: nlattr: set extack msg if validate_nla fails
From: David Ahern @ 2017-12-14 19:45 UTC (permalink / raw)
To: Alexander Aring, jhs; +Cc: xiyou.wangcong, jiri, davem, netdev, kernel
In-Reply-To: <20171214183905.23066-3-aring@mojatatu.com>
On 12/14/17 11:38 AM, Alexander Aring wrote:
> This patch sets a generic netlink error message if the validation of the
> netlink attribute failed. It avoids several different settings of
> netlink messages by handle nla_parse_nested on error case.
>
> Suggested-by: David Ahern <dsahern@gmail.com>
> Signed-off-by: Alexander Aring <aring@mojatatu.com>
> ---
> lib/nlattr.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/lib/nlattr.c b/lib/nlattr.c
> index dfa55c873c13..a2a9506b2fb7 100644
> --- a/lib/nlattr.c
> +++ b/lib/nlattr.c
> @@ -253,8 +253,10 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
> if (policy) {
> err = validate_nla(nla, maxtype, policy);
> if (err < 0) {
> - if (extack)
> + if (extack) {
> + NL_SET_ERR_MSG(extack, "Failed to validate netlink attribute");
> extack->bad_attr = nla;
> + }
> goto errout;
> }
> }
>
I have a similar patch:
if (policy) {
err = validate_nla(nla, maxtype, policy);
if (err < 0) {
- if (extack)
- extack->bad_attr = nla;
+ NL_SET_ERR_MSG_ATTR(extack, nla,
+ "Attribute
failed policy validation");
goto errout;
}
}
Wording wise it notes policy validation failed but more importantly it
combines setting the error message and bad_attr into 1 macro.
^ permalink raw reply
* Re: [PATCH iproute2 1/1] ss: add missing path MTU parameter
From: Roman Mashak @ 2017-12-14 19:51 UTC (permalink / raw)
To: Neal Cardwell; +Cc: Stephen Hemminger, Netdev, Jamal Hadi Salim
In-Reply-To: <CADVnQynM6HX-q-ZA=XiGEcOjU6U5LyVxTqkcE87Vbfoo2mrf-g@mail.gmail.com>
Neal Cardwell <ncardwell@google.com> writes:
> On Thu, Dec 14, 2017 at 2:23 PM, Roman Mashak <mrv@mojatatu.com> wrote:
>>
>> Signed-off-by: Roman Mashak <mrv@mojatatu.com>
>> ---
> ...
>> @@ -1967,6 +1968,8 @@ static void tcp_stats_print(struct tcpstat *s)
>> printf(" cwnd:%u", s->cwnd);
>> if (s->ssthresh)
>> printf(" ssthresh:%d", s->ssthresh);
>> + if (s->pmtu)
>> + printf(" pmtu:%u", s->pmtu);
>
> Would it be possible to print the pmtu immediately after the mss? IMHO
> having related parameters next to each other this way would make this
> easier to parse for humans.
>
> Thanks for adding this!
Sure, I will send v2 with change.
^ permalink raw reply
* Re: [PATCHv2 net-next 03/15] net: sched: sch_api: handle generic qdisc errors
From: David Ahern @ 2017-12-14 19:56 UTC (permalink / raw)
To: Alexander Aring, jhs
Cc: xiyou.wangcong, jiri, davem, netdev, kernel, David Ahern
In-Reply-To: <20171214183905.23066-4-aring@mojatatu.com>
On 12/14/17 11:38 AM, Alexander Aring wrote:
> @@ -912,8 +920,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
> (new && new->flags & TCQ_F_INGRESS)) {
> num_q = 1;
> ingress = 1;
> - if (!dev_ingress_queue(dev))
> + if (!dev_ingress_queue(dev)) {
> + NL_SET_ERR_MSG(extack, "Cannot find ingress queue for specified device");
"Device does not have an ingress queue" ?
> @@ -1241,8 +1262,10 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
> int err;
>
> if ((n->nlmsg_type != RTM_GETQDISC) &&
> - !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
> + !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
> + NL_SET_ERR_MSG(extack, "Net admin permission required for this operation");
EPERM does not need a string.
> @@ -1309,8 +1346,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
> struct Qdisc *q, *p;
> int err;
>
> - if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
> + if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
> + NL_SET_ERR_MSG(extack, "Net admin permission required for this operation");
Ditto here. Please check other patches as well.
> return -EPERM;
> + }
>
> replay:
> /* Reinit, just in case something touches this. */
^ permalink raw reply
* Re: [PATCHv2 net-next 0/8] sctp: Implement Stream Interleave: Interaction with Other SCTP Extensions
From: Neil Horman @ 2017-12-14 19:58 UTC (permalink / raw)
To: Xin Long; +Cc: network dev, linux-sctp, Marcelo Ricardo Leitner, davem
In-Reply-To: <cover.1513269224.git.lucien.xin@gmail.com>
On Fri, Dec 15, 2017 at 12:41:24AM +0800, Xin Long wrote:
> Stream Interleave would be implemented in two Parts:
>
> 1. The I-DATA Chunk Supporting User Message Interleaving
> 2. Interaction with Other SCTP Extensions
>
> Overview in section 2.3 of RFC8260 for Part 2:
>
> The usage of the I-DATA chunk might interfere with other SCTP
> extensions. Future SCTP extensions MUST describe if and how they
> interfere with the usage of I-DATA chunks. For the SCTP extensions
> already defined when this document was published, the details are
> given in the following subsections.
>
> As the 2nd part of Stream Interleave Implementation, this patchset mostly
> adds the support for SCTP Partial Reliability Extension with I-FORWARD-TSN
> chunk. Then adjusts stream scheduler and stream reconfig to make them work
> properly with I-DATA chunks.
>
> In the last patch, all stream interleave codes will be enabled by adding
> sysctl to allow users to use this feature.
>
> v1 -> v2:
> - removed the intl_enable check from sctp_chunk_event_lookup, as Marcelo's
> suggestion.
> - fixed a typo in changelog.
>
> Xin Long (8):
> sctp: add basic structures and make chunk function for ifwdtsn
> sctp: implement generate_ftsn for sctp_stream_interleave
> sctp: implement validate_ftsn for sctp_stream_interleave
> sctp: implement report_ftsn for sctp_stream_interleave
> sctp: implement handle_ftsn for sctp_stream_interleave
> sctp: add stream interleave support in stream scheduler
> sctp: update mid instead of ssn when doing stream and asoc reset
> sctp: support sysctl to allow users to use stream interleave
>
> include/linux/sctp.h | 17 +++
> include/net/sctp/sm.h | 3 +
> include/net/sctp/stream_interleave.h | 7 ++
> include/net/sctp/structs.h | 12 ++
> net/sctp/outqueue.c | 12 +-
> net/sctp/sm_make_chunk.c | 24 ++++
> net/sctp/sm_sideeffect.c | 24 +---
> net/sctp/sm_statefuns.c | 24 ++--
> net/sctp/sm_statetable.c | 4 +-
> net/sctp/stream.c | 46 +++++---
> net/sctp/stream_interleave.c | 216 +++++++++++++++++++++++++++++++++++
> net/sctp/stream_sched.c | 3 +-
> net/sctp/sysctl.c | 7 ++
> 13 files changed, 334 insertions(+), 65 deletions(-)
>
> --
> 2.1.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
For the series
Acked-by: Neil Horman <nhorman@tuxdriver.com>
^ permalink raw reply
* [PATCH v2 iproute2 1/1] ss: add missing path MTU parameter
From: Roman Mashak @ 2017-12-14 19:59 UTC (permalink / raw)
To: stephen; +Cc: netdev, jhs, Roman Mashak
v2:
Print the path MTU immediately after the MSS, as it is easier to parse
for humans (suggested by Neal Cardwell).
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
---
man/man8/ss.8 | 4 ++++
misc/ss.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/man/man8/ss.8 b/man/man8/ss.8
index 6d06383..0d52673 100644
--- a/man/man8/ss.8
+++ b/man/man8/ss.8
@@ -184,6 +184,10 @@ max segment size
congestion window size
.P
.TP
+.B pmtu:<pmtu>
+path MTU value
+.P
+.TP
.B ssthresh:<ssthresh>
tcp congestion window slow start threshold
.P
diff --git a/misc/ss.c b/misc/ss.c
index da52d5e..b43bd0b 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -727,6 +727,7 @@ struct tcpstat {
int mss;
int rcv_mss;
int advmss;
+ unsigned int pmtu;
unsigned int cwnd;
unsigned int lastsnd;
unsigned int lastrcv;
@@ -1959,6 +1960,8 @@ static void tcp_stats_print(struct tcpstat *s)
if (s->mss)
printf(" mss:%d", s->mss);
+ if (s->pmtu)
+ printf(" pmtu:%u", s->pmtu);
if (s->rcv_mss)
printf(" rcvmss:%d", s->rcv_mss);
if (s->advmss)
@@ -2308,6 +2311,7 @@ static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
s.reordering = info->tcpi_reordering;
s.rcv_ssthresh = info->tcpi_rcv_ssthresh;
s.cwnd = info->tcpi_snd_cwnd;
+ s.pmtu = info->tcpi_pmtu;
if (info->tcpi_snd_ssthresh < 0xFFFF)
s.ssthresh = info->tcpi_snd_ssthresh;
--
2.7.4
^ permalink raw reply related
* Re: [PATCH net-next v4 0/5] Introduce NETIF_F_GRO_HW
From: Or Gerlitz @ 2017-12-14 20:01 UTC (permalink / raw)
To: Michael Chan
Cc: David Miller, Linux Netdev List, Andy Gospodarek, Gal Pressman
In-Reply-To: <CACKFLi=JhTRD8jK+HqDcTxJHcYzKoGXNfUXs9DKiFQULDUkKYg@mail.gmail.com>
On Thu, Dec 14, 2017 at 8:36 PM, Michael Chan <michael.chan@broadcom.com> wrote:
> On Thu, Dec 14, 2017 at 8:34 AM, Or Gerlitz <gerlitz.or@gmail.com> wrote:
>> On Mon, Dec 11, 2017 at 1:41 PM, Michael Chan <michael.chan@broadcom.com> wrote:
>>> Introduce NETIF_F_GRO_HW feature flag and convert drivers that support
>>> hardware GRO to use the new flag.
>>
>> Hi Michael,
>>
>> Could you add more performance motivations/results? looking on your
>> netconf slides [1]
>> I see (much) better CPU utilization (slide 5) -- do you have more
>> numbers to share?
>
> The motivations are the same as LRO: to achieve higher RX throughput
> and lower CPU utilization.
makes sense, what is the +/- %% improvement in RX throughput you see?
> You can think of it as an improved version of LRO that is stricter and
> provides more information to construct the GRO frame so that it is
> reversible.
sounds good to me
^ permalink raw reply
* Re: [PATCHv2 net-next 09/15] net: sch: api: add extack support in qdisc_get_rtab
From: David Ahern @ 2017-12-14 20:02 UTC (permalink / raw)
To: Alexander Aring, jhs
Cc: xiyou.wangcong, jiri, davem, netdev, kernel, David Ahern
In-Reply-To: <20171214183905.23066-10-aring@mojatatu.com>
On 12/14/17 11:38 AM, Alexander Aring wrote:
> diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
> index 816e8b0c2609..24b286d763b7 100644
> --- a/net/sched/sch_api.c
> +++ b/net/sched/sch_api.c
> @@ -393,13 +393,16 @@ static __u8 __detect_linklayer(struct tc_ratespec *r, __u32 *rtab)
> static struct qdisc_rate_table *qdisc_rtab_list;
>
> struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
> - struct nlattr *tab)
> + struct nlattr *tab,
> + struct netlink_ext_ack *extack)
> {
> struct qdisc_rate_table *rtab;
>
> if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
> - nla_len(tab) != TC_RTAB_SIZE)
> + nla_len(tab) != TC_RTAB_SIZE) {
> + NL_SET_ERR_MSG(extack, "Invalid rtab parameters for searching");
What is rtab short for? Can you expand that to something meaningful to
the user?
> return NULL;
> + }
>
> for (rtab = qdisc_rtab_list; rtab; rtab = rtab->next) {
> if (!memcmp(&rtab->rate, r, sizeof(struct tc_ratespec)) &&
> @@ -418,6 +421,8 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
> r->linklayer = __detect_linklayer(r, rtab->data);
> rtab->next = qdisc_rtab_list;
> qdisc_rtab_list = rtab;
> + } else {
> + NL_SET_ERR_MSG(extack, "Failed to allocate new qdisc rtab");
ditto here
^ permalink raw reply
* Re: [PATCH] openvswitch: Trim off padding before L3 conntrack processing
From: Ed Swierk @ 2017-12-14 20:05 UTC (permalink / raw)
To: Pravin Shelar
Cc: ovs-dev, Linux Kernel Network Developers, Lance Richardson,
Benjamin Warren, Keith Holleman
In-Reply-To: <CAOrHB_CeoZ-MSmYNrMniccdTnT+VYUGEStq38CEi1HjtyGeJHA@mail.gmail.com>
On Wed, Dec 13, 2017 at 4:58 PM, Pravin Shelar <pshelar@ovn.org> wrote:
> On Tue, Dec 12, 2017 at 8:17 AM, Ed Swierk <eswierk@skyportsystems.com> wrote:
>> A short IPv4 packet may have up to 6 bytes of padding following the IP
>> payload when received on an Ethernet device.
>>
>> In the normal IPv4 receive path, ip_rcv() trims the packet to
>> ip_hdr->tot_len before invoking NF_INET_PRE_ROUTING hooks (including
>> conntrack). Then any subsequent L3+ processing steps, like
>> nf_checksum(), use skb->len as the length of the packet, rather than
>> referring back to ip_hdr->tot_len. In the IPv6 receive path, ip6_rcv()
>> does the same using ipv6_hdr->payload_len.
>>
>> In the OVS conntrack receive path, this trimming does not occur, so
>> the checksum verification in tcp_header() fails, printing "nf_ct_tcp:
>> bad TCP checksum". Extra zero bytes don't affect the checksum, but the
>> length in the IP pseudoheader does. That length is based on skb->len,
>> and without trimming, it doesn't match the length the sender used when
>> computing the checksum.
>>
>> With this change, OVS conntrack trims IPv4 and IPv6 packets prior to
>> L3 processing.
>>
>> Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
>> ---
>> net/openvswitch/conntrack.c | 17 +++++++++++++++++
>> 1 file changed, 17 insertions(+)
>>
>> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
>> index d558e882ca0c..3a7c9215c431 100644
>> --- a/net/openvswitch/conntrack.c
>> +++ b/net/openvswitch/conntrack.c
>> @@ -1105,12 +1105,29 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
>> const struct ovs_conntrack_info *info)
>> {
>> int nh_ofs;
>> + unsigned int nh_len;
>> int err;
>>
>> /* The conntrack module expects to be working at L3. */
>> nh_ofs = skb_network_offset(skb);
>> skb_pull_rcsum(skb, nh_ofs);
>>
>> + /* Trim to L3 length since nf_checksum() doesn't expect padding. */
> Can you explore if nf_checksum can be changed to avoid the padding?
The nf_ip_checksum() and nf_ip6_checksum() helper functions can easily
be changed to avoid the padding.
My worry is that conntrack is just one of many netfilter hooks that
perform L3+ processing, and may assume that once skb->data points to
the L3 header, skb->len reflects the length of the L3 header and
payload. For example, in nf_conntrack_ftp.c, help() uses skb->len to
determine the length of the FTP payload and the TCP sequence number of
the next packet; this would be thrown off by lower-layer padding.
br_netfilter, a cousin of OVS, has always preserved this
assumption--like ip_rcv() and ip6_rcv(), br_validate_ipv4() and
br_validate_ipv6() trim the skb to the L3 length before they invoke
NF_INET_PRE_ROUTING hooks. Modifying OVS to fit the mold seems more
straightforward than changing this assumption.
>> + switch (skb->protocol) {
>> + case htons(ETH_P_IP):
>> + nh_len = ntohs(ip_hdr(skb)->tot_len);
>> + break;
>> + case htons(ETH_P_IPV6):
>> + nh_len = ntohs(ipv6_hdr(skb)->payload_len)
>> + + sizeof(struct ipv6hdr);
>> + break;
>> + default:
>> + nh_len = skb->len;
>> + }
>> + err = pskb_trim_rcsum(skb, nh_len);
>> + if (err)
>> + return err;
>> +
> In case of error skb needs to be freed.
Thanks, I will fix this.
--Ed
^ permalink raw reply
* [PATCH bpf 0/5] Couple of BPF JIT fixes
From: Daniel Borkmann @ 2017-12-14 20:07 UTC (permalink / raw)
To: ast; +Cc: holzheu, naveen.n.rao, davem, netdev, Daniel Borkmann
Two fixes that deal with buggy usage of bpf_helper_changes_pkt_data()
in the sense that they also reload cached skb data when there's no
skb context but xdp one, for example. A fix where skb meta data is
reloaded out of the wrong register on helper call, rest is test cases
and making sure on verifier side that there's always the guarantee
that ctx sits in r1. Thanks!
Daniel Borkmann (5):
bpf, s390x: do not reload skb pointers in non-skb context
bpf, ppc64: do not reload skb pointers in non-skb context
bpf: guarantee r1 to be ctx in case of bpf_helper_changes_pkt_data
bpf, sparc: fix usage of wrong reg for load_skb_regs after call
bpf: add test case for ld_abs and helper changing pkt data
arch/powerpc/net/bpf_jit_comp64.c | 6 ++--
arch/s390/net/bpf_jit_comp.c | 11 ++++----
arch/sparc/net/bpf_jit_comp_64.c | 6 ++--
kernel/bpf/verifier.c | 6 ++++
lib/test_bpf.c | 43 +++++++++++++++++++++++++++++
tools/testing/selftests/bpf/test_verifier.c | 24 ++++++++++++++++
6 files changed, 86 insertions(+), 10 deletions(-)
--
2.9.5
^ permalink raw reply
* [PATCH bpf 2/5] bpf, ppc64: do not reload skb pointers in non-skb context
From: Daniel Borkmann @ 2017-12-14 20:07 UTC (permalink / raw)
To: ast; +Cc: holzheu, naveen.n.rao, davem, netdev, Daniel Borkmann
In-Reply-To: <20171214200727.22230-1-daniel@iogearbox.net>
The assumption of unconditionally reloading skb pointers on
BPF helper calls where bpf_helper_changes_pkt_data() holds
true is wrong. There can be different contexts where the helper
would enforce a reload such as in case of XDP. Here, we do
have a struct xdp_buff instead of struct sk_buff as context,
thus this will access garbage.
JITs only ever need to deal with cached skb pointer reload
when ld_abs/ind was seen, therefore guard the reload behind
SEEN_SKB.
Fixes: 156d0e290e96 ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Sandipan Das <sandipan@linux.vnet.ibm.com>
---
arch/powerpc/net/bpf_jit_comp64.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 46d74e8..d183b48 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -763,7 +763,8 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
func = (u8 *) __bpf_call_base + imm;
/* Save skb pointer if we need to re-cache skb data */
- if (bpf_helper_changes_pkt_data(func))
+ if ((ctx->seen & SEEN_SKB) &&
+ bpf_helper_changes_pkt_data(func))
PPC_BPF_STL(3, 1, bpf_jit_stack_local(ctx));
bpf_jit_emit_func_call(image, ctx, (u64)func);
@@ -772,7 +773,8 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
PPC_MR(b2p[BPF_REG_0], 3);
/* refresh skb cache */
- if (bpf_helper_changes_pkt_data(func)) {
+ if ((ctx->seen & SEEN_SKB) &&
+ bpf_helper_changes_pkt_data(func)) {
/* reload skb pointer to r3 */
PPC_BPF_LL(3, 1, bpf_jit_stack_local(ctx));
bpf_jit_emit_skb_loads(image, ctx);
--
2.9.5
^ permalink raw reply related
* [PATCH bpf 1/5] bpf, s390x: do not reload skb pointers in non-skb context
From: Daniel Borkmann @ 2017-12-14 20:07 UTC (permalink / raw)
To: ast; +Cc: holzheu, naveen.n.rao, davem, netdev, Daniel Borkmann
In-Reply-To: <20171214200727.22230-1-daniel@iogearbox.net>
The assumption of unconditionally reloading skb pointers on
BPF helper calls where bpf_helper_changes_pkt_data() holds
true is wrong. There can be different contexts where the
BPF helper would enforce a reload such as in case of XDP.
Here, we do have a struct xdp_buff instead of struct sk_buff
as context, thus this will access garbage.
JITs only ever need to deal with cached skb pointer reload
when ld_abs/ind was seen, therefore guard the reload behind
SEEN_SKB only. Tested on s390x.
Fixes: 9db7f2b81880 ("s390/bpf: recache skb->data/hlen for skb_vlan_push/pop")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
---
arch/s390/net/bpf_jit_comp.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index e81c168..9557d8b 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -55,8 +55,7 @@ struct bpf_jit {
#define SEEN_LITERAL 8 /* code uses literals */
#define SEEN_FUNC 16 /* calls C functions */
#define SEEN_TAIL_CALL 32 /* code uses tail calls */
-#define SEEN_SKB_CHANGE 64 /* code changes skb data */
-#define SEEN_REG_AX 128 /* code uses constant blinding */
+#define SEEN_REG_AX 64 /* code uses constant blinding */
#define SEEN_STACK (SEEN_FUNC | SEEN_MEM | SEEN_SKB)
/*
@@ -448,12 +447,12 @@ static void bpf_jit_prologue(struct bpf_jit *jit, u32 stack_depth)
EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
REG_15, 152);
}
- if (jit->seen & SEEN_SKB)
+ if (jit->seen & SEEN_SKB) {
emit_load_skb_data_hlen(jit);
- if (jit->seen & SEEN_SKB_CHANGE)
/* stg %b1,ST_OFF_SKBP(%r0,%r15) */
EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_1, REG_0, REG_15,
STK_OFF_SKBP);
+ }
}
/*
@@ -983,8 +982,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
EMIT2(0x0d00, REG_14, REG_W1);
/* lgr %b0,%r2: load return value into %b0 */
EMIT4(0xb9040000, BPF_REG_0, REG_2);
- if (bpf_helper_changes_pkt_data((void *)func)) {
- jit->seen |= SEEN_SKB_CHANGE;
+ if ((jit->seen & SEEN_SKB) &&
+ bpf_helper_changes_pkt_data((void *)func)) {
/* lg %b1,ST_OFF_SKBP(%r15) */
EMIT6_DISP_LH(0xe3000000, 0x0004, BPF_REG_1, REG_0,
REG_15, STK_OFF_SKBP);
--
2.9.5
^ permalink raw reply related
* [PATCH bpf 3/5] bpf: guarantee r1 to be ctx in case of bpf_helper_changes_pkt_data
From: Daniel Borkmann @ 2017-12-14 20:07 UTC (permalink / raw)
To: ast; +Cc: holzheu, naveen.n.rao, davem, netdev, Daniel Borkmann
In-Reply-To: <20171214200727.22230-1-daniel@iogearbox.net>
Some JITs don't cache skb context on stack in prologue, so when
LD_ABS/IND is used and helper calls yield bpf_helper_changes_pkt_data()
as true, then they temporarily save/restore skb pointer. However,
the assumption that skb always has to be in r1 is a bit of a
gamble. Right now it turned out to be true for all helpers listed
in bpf_helper_changes_pkt_data(), but lets enforce that from verifier
side, so that we make this a guarantee and bail out if the func
proto is misconfigured in future helpers.
In case of BPF helper calls from cBPF, bpf_helper_changes_pkt_data()
is completely unrelevant here (since cBPF is context read-only) and
therefore always false.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
---
kernel/bpf/verifier.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d459357..e39b013 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1674,7 +1674,13 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
return -EINVAL;
}
+ /* With LD_ABS/IND some JITs save/restore skb from r1. */
changes_data = bpf_helper_changes_pkt_data(fn->func);
+ if (changes_data && fn->arg1_type != ARG_PTR_TO_CTX) {
+ verbose(env, "kernel subsystem misconfigured func %s#%d: r1 != ctx\n",
+ func_id_name(func_id), func_id);
+ return -EINVAL;
+ }
memset(&meta, 0, sizeof(meta));
meta.pkt_access = fn->pkt_access;
--
2.9.5
^ permalink raw reply related
* [PATCH bpf 4/5] bpf, sparc: fix usage of wrong reg for load_skb_regs after call
From: Daniel Borkmann @ 2017-12-14 20:07 UTC (permalink / raw)
To: ast; +Cc: holzheu, naveen.n.rao, davem, netdev, Daniel Borkmann
In-Reply-To: <20171214200727.22230-1-daniel@iogearbox.net>
When LD_ABS/IND is used in the program, and we have a BPF helper
call that changes packet data (bpf_helper_changes_pkt_data() returns
true), then in case of sparc JIT, we try to reload cached skb data
from bpf2sparc[BPF_REG_6]. However, there is no such guarantee or
assumption that skb sits in R6 at this point, all helpers changing
skb data only have a guarantee that skb sits in R1. Therefore,
store BPF R1 in L7 temporarily and after procedure call use L7 to
reload cached skb data. skb sitting in R6 is only true at the time
when LD_ABS/IND is executed.
Fixes: 7a12b5031c6b ("sparc64: Add eBPF JIT.")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
---
arch/sparc/net/bpf_jit_comp_64.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
index 5765e7e..ff5f9cb 100644
--- a/arch/sparc/net/bpf_jit_comp_64.c
+++ b/arch/sparc/net/bpf_jit_comp_64.c
@@ -1245,14 +1245,16 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
u8 *func = ((u8 *)__bpf_call_base) + imm;
ctx->saw_call = true;
+ if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
+ emit_reg_move(bpf2sparc[BPF_REG_1], L7, ctx);
emit_call((u32 *)func, ctx);
emit_nop(ctx);
emit_reg_move(O0, bpf2sparc[BPF_REG_0], ctx);
- if (bpf_helper_changes_pkt_data(func) && ctx->saw_ld_abs_ind)
- load_skb_regs(ctx, bpf2sparc[BPF_REG_6]);
+ if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
+ load_skb_regs(ctx, L7);
break;
}
--
2.9.5
^ permalink raw reply related
* [PATCH bpf 5/5] bpf: add test case for ld_abs and helper changing pkt data
From: Daniel Borkmann @ 2017-12-14 20:07 UTC (permalink / raw)
To: ast; +Cc: holzheu, naveen.n.rao, davem, netdev, Daniel Borkmann
In-Reply-To: <20171214200727.22230-1-daniel@iogearbox.net>
Add a test that i) uses LD_ABS, ii) zeroing R6 before call, iii) calls
a helper that triggers reload of cached skb data, iv) uses LD_ABS again.
It's added for test_bpf in order to do runtime testing after JITing as
well as test_verifier to test that the sequence is allowed.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
---
lib/test_bpf.c | 43 +++++++++++++++++++++++++++++
tools/testing/selftests/bpf/test_verifier.c | 24 ++++++++++++++++
2 files changed, 67 insertions(+)
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index aa8812a..9e97480 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -435,6 +435,41 @@ static int bpf_fill_ld_abs_vlan_push_pop(struct bpf_test *self)
return 0;
}
+static int bpf_fill_ld_abs_vlan_push_pop2(struct bpf_test *self)
+{
+ struct bpf_insn *insn;
+
+ insn = kmalloc_array(16, sizeof(*insn), GFP_KERNEL);
+ if (!insn)
+ return -ENOMEM;
+
+ /* Due to func address being non-const, we need to
+ * assemble this here.
+ */
+ insn[0] = BPF_MOV64_REG(R6, R1);
+ insn[1] = BPF_LD_ABS(BPF_B, 0);
+ insn[2] = BPF_LD_ABS(BPF_H, 0);
+ insn[3] = BPF_LD_ABS(BPF_W, 0);
+ insn[4] = BPF_MOV64_REG(R7, R6);
+ insn[5] = BPF_MOV64_IMM(R6, 0);
+ insn[6] = BPF_MOV64_REG(R1, R7);
+ insn[7] = BPF_MOV64_IMM(R2, 1);
+ insn[8] = BPF_MOV64_IMM(R3, 2);
+ insn[9] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+ bpf_skb_vlan_push_proto.func - __bpf_call_base);
+ insn[10] = BPF_MOV64_REG(R6, R7);
+ insn[11] = BPF_LD_ABS(BPF_B, 0);
+ insn[12] = BPF_LD_ABS(BPF_H, 0);
+ insn[13] = BPF_LD_ABS(BPF_W, 0);
+ insn[14] = BPF_MOV64_IMM(R0, 42);
+ insn[15] = BPF_EXIT_INSN();
+
+ self->u.ptr.insns = insn;
+ self->u.ptr.len = 16;
+
+ return 0;
+}
+
static int bpf_fill_jump_around_ld_abs(struct bpf_test *self)
{
unsigned int len = BPF_MAXINSNS;
@@ -6066,6 +6101,14 @@ static struct bpf_test tests[] = {
{},
{ {0x1, 0x42 } },
},
+ {
+ "LD_ABS with helper changing skb data",
+ { },
+ INTERNAL,
+ { 0x34 },
+ { { ETH_HLEN, 42 } },
+ .fill_helper = bpf_fill_ld_abs_vlan_push_pop2,
+ },
};
static struct net_device dev;
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 3c64f30..b03ecfd 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6117,6 +6117,30 @@ static struct bpf_test tests[] = {
.result = ACCEPT,
},
{
+ "ld_abs: tests on r6 and skb data reload helper",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_LD_ABS(BPF_B, 0),
+ BPF_LD_ABS(BPF_H, 0),
+ BPF_LD_ABS(BPF_W, 0),
+ BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
+ BPF_MOV64_IMM(BPF_REG_6, 0),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
+ BPF_MOV64_IMM(BPF_REG_2, 1),
+ BPF_MOV64_IMM(BPF_REG_3, 2),
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+ BPF_FUNC_skb_vlan_push),
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
+ BPF_LD_ABS(BPF_B, 0),
+ BPF_LD_ABS(BPF_H, 0),
+ BPF_LD_ABS(BPF_W, 0),
+ BPF_MOV64_IMM(BPF_REG_0, 42),
+ BPF_EXIT_INSN(),
+ },
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
+ },
+ {
"ld_ind: check calling conv, r1",
.insns = {
BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
--
2.9.5
^ permalink raw reply related
* Re: [PATCHv2 net-next 10/15] net: sch: api: add extack support in tcf_block_get
From: David Ahern @ 2017-12-14 20:08 UTC (permalink / raw)
To: Alexander Aring, jhs
Cc: xiyou.wangcong, jiri, davem, netdev, kernel, David Ahern
In-Reply-To: <20171214183905.23066-11-aring@mojatatu.com>
On 12/14/17 11:39 AM, Alexander Aring wrote:
> diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
> index 446ef956a79c..173107ed3726 100644
> --- a/net/sched/cls_api.c
> +++ b/net/sched/cls_api.c
> @@ -282,20 +282,24 @@ static void tcf_block_offload_unbind(struct tcf_block *block, struct Qdisc *q,
> }
>
> int tcf_block_get_ext(struct tcf_block **p_block, struct Qdisc *q,
> - struct tcf_block_ext_info *ei)
> + struct tcf_block_ext_info *ei,
> + struct netlink_ext_ack *extack)
> {
> struct tcf_block *block = kzalloc(sizeof(*block), GFP_KERNEL);
> struct tcf_chain *chain;
> int err;
>
> - if (!block)
> + if (!block) {
> + NL_SET_ERR_MSG(extack, "No tcf block given");
Wrong message for the failure. !block means kzalloc failed.
> return -ENOMEM;
> + }
> INIT_LIST_HEAD(&block->chain_list);
> INIT_LIST_HEAD(&block->cb_list);
>
> /* Create chain 0 by default, it has to be always present. */
> chain = tcf_chain_create(block, 0);
> if (!chain) {
> + NL_SET_ERR_MSG(extack, "Failed to create new tcf chain");
> err = -ENOMEM;
> goto err_chain_create;
> }
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox