* Re: [PATCH RFC net-next 7/7] netdevsim: Add simple FIB resource controller via devlink
From: David Ahern @ 2018-03-23 15:03 UTC (permalink / raw)
To: Jiri Pirko
Cc: netdev, davem, roopa, shm, jiri, idosch, jakub.kicinski,
David Ahern
In-Reply-To: <20180323150149.GD2125@nanopsycho>
On 3/23/18 9:01 AM, Jiri Pirko wrote:
> Fri, Mar 23, 2018 at 03:31:02PM CET, dsa@cumulusnetworks.com wrote:
>> On 3/23/18 12:50 AM, Jiri Pirko wrote:
>>>> +void nsim_devlink_setup(struct netdevsim *ns)
>>>> +{
>>>> + struct net *net = dev_net(ns->netdev);
>>>> + bool *reg_devlink = net_generic(net, nsim_devlink_id);
>>>> + struct devlink *devlink;
>>>> + int err = -ENOMEM;
>>>> +
>>>> + /* only one device per namespace controls devlink */
>>>> + if (!*reg_devlink) {
>>>> + ns->devlink = NULL;
>>>> + return;
>>>> + }
>>>> +
>>>> + devlink = devlink_alloc(&nsim_devlink_ops, 0);
>>>> + if (!devlink)
>>>> + return;
>>>> +
>>>> + devlink_net_set(devlink, net);
>>>> + err = devlink_register(devlink, &ns->dev);
>>>
>>> This reg_devlink construct looks odd. Why don't you leave the devlink
>>> instance in init_ns?
>>
>> It is a per-network namespace resource controller. Since struct devlink
>
> Wait a second. What do you mean by "per-network namespace"? Devlink
> instance is always associated with one physical device. Like an ASIC.
>
>
>> has a net entry, the simplest design is to put it into the namespace of
>> the controller. Without it, controlling resource sizes in namespace
>> 'foobar' has to be done from init_net, which is just wrong.
you need to look at how netdevsim creates a device per netdevice.
^ permalink raw reply
* Re: [PATCH RFC net-next 7/7] netdevsim: Add simple FIB resource controller via devlink
From: Jiri Pirko @ 2018-03-23 15:01 UTC (permalink / raw)
To: David Ahern
Cc: netdev, davem, roopa, shm, jiri, idosch, jakub.kicinski,
David Ahern
In-Reply-To: <03eade79-1727-3a31-8e31-a0a7f51b72cf@cumulusnetworks.com>
Fri, Mar 23, 2018 at 03:31:02PM CET, dsa@cumulusnetworks.com wrote:
>On 3/23/18 12:50 AM, Jiri Pirko wrote:
>>> +void nsim_devlink_setup(struct netdevsim *ns)
>>> +{
>>> + struct net *net = dev_net(ns->netdev);
>>> + bool *reg_devlink = net_generic(net, nsim_devlink_id);
>>> + struct devlink *devlink;
>>> + int err = -ENOMEM;
>>> +
>>> + /* only one device per namespace controls devlink */
>>> + if (!*reg_devlink) {
>>> + ns->devlink = NULL;
>>> + return;
>>> + }
>>> +
>>> + devlink = devlink_alloc(&nsim_devlink_ops, 0);
>>> + if (!devlink)
>>> + return;
>>> +
>>> + devlink_net_set(devlink, net);
>>> + err = devlink_register(devlink, &ns->dev);
>>
>> This reg_devlink construct looks odd. Why don't you leave the devlink
>> instance in init_ns?
>
>It is a per-network namespace resource controller. Since struct devlink
Wait a second. What do you mean by "per-network namespace"? Devlink
instance is always associated with one physical device. Like an ASIC.
>has a net entry, the simplest design is to put it into the namespace of
>the controller. Without it, controlling resource sizes in namespace
>'foobar' has to be done from init_net, which is just wrong.
^ permalink raw reply
* Re: [patch net-next RFC 00/12] devlink: introduce port flavours and common phys_port_name generation
From: Jiri Pirko @ 2018-03-23 14:59 UTC (permalink / raw)
To: Andrew Lunn
Cc: netdev, davem, idosch, jakub.kicinski, mlxsw, vivien.didelot,
f.fainelli, michael.chan, ganeshgr, saeedm, simon.horman,
pieter.jansenvanvuuren, john.hurley, dirk.vandermerwe,
alexander.h.duyck, ogerlitz, dsahern, vijaya.guvva,
satananda.burla, raghu.vatsavayi, felix.manlunas, gospo,
sathya.perla, vasundhara-v.volam, tariqt, eranbe,
jeffrey.t.kirsher
In-Reply-To: <20180323134357.GG5145@lunn.ch>
Fri, Mar 23, 2018 at 02:43:57PM CET, andrew@lunn.ch wrote:
>> I tested this for mlxsw and nfp. I have no way to test this on DSA hw,
>> I would really appretiate DSA guys to test this.
>
>Hi Jiri
>
>With the missing break added, i get:
>
>root@zii-devel-b:~# ./iproute2/devlink/devlink port
>mdio_bus/0.1:00/0: type eth netdev lan0 flavour physical number 0
>mdio_bus/0.1:00/1: type eth netdev lan1 flavour physical number 1
>mdio_bus/0.1:00/2: type eth netdev lan2 flavour physical number 2
>mdio_bus/0.1:00/3: type notset
>mdio_bus/0.1:00/4: type notset
>mdio_bus/0.1:00/5: type notset flavour dsa number 5
>mdio_bus/0.1:00/6: type notset flavour cpu number 6
>mdio_bus/0.2:00/0: type eth netdev lan3 flavour physical number 0
>mdio_bus/0.2:00/1: type eth netdev lan4 flavour physical number 1
>mdio_bus/0.2:00/2: type eth netdev lan5 flavour physical number 2
>mdio_bus/0.2:00/3: type notset
>mdio_bus/0.2:00/4: type notset
>mdio_bus/0.2:00/5: type notset flavour dsa number 5
>mdio_bus/0.2:00/6: type notset flavour dsa number 6
>mdio_bus/0.4:00/0: type eth netdev lan6 flavour physical number 0
>mdio_bus/0.4:00/1: type eth netdev lan7 flavour physical number 1
>mdio_bus/0.4:00/2: type eth netdev lan8 flavour physical number 2
>mdio_bus/0.4:00/3: type eth netdev optical3 flavour physical number 3
>mdio_bus/0.4:00/4: type eth netdev optical4 flavour physical number 4
>mdio_bus/0.4:00/5: type notset
>mdio_bus/0.4:00/6: type notset
>mdio_bus/0.4:00/7: type notset
>mdio_bus/0.4:00/8: type notset
>mdio_bus/0.4:00/9: type notset flavour dsa number 9
>
>This is on a board with a DSA cluster of three switches. Some of the
>switch ports are not connected to anything, so are plain 'notset'.
Okay. That looks fine. I wonder if it would make sense to have another
flavour for "unused" ports.
>
>What is the "number X" meant to mean?
That is basically front panel number for physical ports. It is used for
generating phys_port_name. It should have separate numbering for cpu
ports and dsa ports most probably. Although, since they have no
netdevice associated, the number is not used and only shown here.
In case of mlxsw switch port 1, the netdev name is then
for example: "enp3s0np1".
^ permalink raw reply
* Re: l2tp stable request
From: Guillaume Nault @ 2018-03-23 14:58 UTC (permalink / raw)
To: Daniel Rosenberg; +Cc: netdev, Greg Kroah-Hartman, stable
In-Reply-To: <fbb33606-b817-356f-acaa-81aab44327cb@google.com>
On Thu, Mar 22, 2018 at 05:55:30PM -0700, Daniel Rosenberg wrote:
> f3c66d4e144a0904ea9b95d23ed9f8eb38c11bfb l2tp: prevent creation of
> sessions on terminated tunnels
> 9ee369a405c57613d7c83a3967780c3e30c52ecc l2tp: initialise session's
> refcount before making it reachable
> dbdbc73b44782e22b3b4b6e8b51e7a3d245f3086 l2tp: fix duplicate session
> creation
> 61b9a047729bb230978178bca6729689d0c50ca2 l2tp: fix race in
> l2tp_recv_common()
>
> For v3.18+. It requires some minor backporting.
>
> Without these, I'm seeing a null pointer in l2tp_session_create. These logs
> are from a 3.18 kernel, although I was able to hit it on a 4.4 kernel I
> tested as well.
>
No objection from me. Let me know if there are any difficulties with a
backport.
Guillaume
^ permalink raw reply
* [PATCH net] ipv6: fix possible deadlock in rt6_age_examine_exception()
From: Eric Dumazet @ 2018-03-23 14:56 UTC (permalink / raw)
To: David S . Miller
Cc: netdev, Eric Dumazet, Eric Dumazet, Wei Wang, Martin KaFai Lau
syzbot reported a LOCKDEP splat [1] in rt6_age_examine_exception()
rt6_age_examine_exception() is called while rt6_exception_lock is held.
This lock is the lower one in the lock hierarchy, thus we can not
call dst_neigh_lookup() function, as it can fallback to neigh_create()
We should instead do a pure RCU lookup. As a bonus we avoid
a pair of atomic operations on neigh refcount.
[1]
WARNING: possible circular locking dependency detected
4.16.0-rc4+ #277 Not tainted
syz-executor7/4015 is trying to acquire lock:
(&ndev->lock){++--}, at: [<00000000416dce19>] __ipv6_dev_mc_dec+0x45/0x350 net/ipv6/mcast.c:928
but task is already holding lock:
(&tbl->lock){++-.}, at: [<00000000b5cb1d65>] neigh_ifdown+0x3d/0x250 net/core/neighbour.c:292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&tbl->lock){++-.}:
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312
__neigh_create+0x87e/0x1d90 net/core/neighbour.c:528
neigh_create include/net/neighbour.h:315 [inline]
ip6_neigh_lookup+0x9a7/0xba0 net/ipv6/route.c:228
dst_neigh_lookup include/net/dst.h:405 [inline]
rt6_age_examine_exception net/ipv6/route.c:1609 [inline]
rt6_age_exceptions+0x381/0x660 net/ipv6/route.c:1645
fib6_age+0xfb/0x140 net/ipv6/ip6_fib.c:2033
fib6_clean_node+0x389/0x580 net/ipv6/ip6_fib.c:1919
fib6_walk_continue+0x46c/0x8a0 net/ipv6/ip6_fib.c:1845
fib6_walk+0x91/0xf0 net/ipv6/ip6_fib.c:1893
fib6_clean_tree+0x1e6/0x340 net/ipv6/ip6_fib.c:1970
__fib6_clean_all+0x1f4/0x3a0 net/ipv6/ip6_fib.c:1986
fib6_clean_all net/ipv6/ip6_fib.c:1997 [inline]
fib6_run_gc+0x16b/0x3c0 net/ipv6/ip6_fib.c:2053
ndisc_netdev_event+0x3c2/0x4a0 net/ipv6/ndisc.c:1781
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x262/0x430 net/core/dev.c:6960
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
devinet_ioctl+0x126a/0x1ac0 net/ipv4/devinet.c:1080
inet_ioctl+0x184/0x310 net/ipv4/af_inet.c:919
sock_do_ioctl+0xef/0x390 net/socket.c:957
sock_ioctl+0x36b/0x610 net/socket.c:1081
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
-> #2 (rt6_exception_lock){+.-.}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:315 [inline]
rt6_flush_exceptions+0x21/0x210 net/ipv6/route.c:1367
fib6_del_route net/ipv6/ip6_fib.c:1677 [inline]
fib6_del+0x624/0x12c0 net/ipv6/ip6_fib.c:1761
__ip6_del_rt+0xc7/0x120 net/ipv6/route.c:2980
ip6_del_rt+0x132/0x1a0 net/ipv6/route.c:2993
__ipv6_dev_ac_dec+0x3b1/0x600 net/ipv6/anycast.c:332
ipv6_dev_ac_dec net/ipv6/anycast.c:345 [inline]
ipv6_sock_ac_close+0x2b4/0x3e0 net/ipv6/anycast.c:200
inet6_release+0x48/0x70 net/ipv6/af_inet6.c:433
sock_release+0x8d/0x1e0 net/socket.c:594
sock_close+0x16/0x20 net/socket.c:1149
__fput+0x327/0x7e0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x199/0x270 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x9bb/0x1ad0 kernel/exit.c:865
do_group_exit+0x149/0x400 kernel/exit.c:968
get_signal+0x73a/0x16d0 kernel/signal.c:2469
do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
do_syscall_64+0x6ec/0x940 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
-> #1 (&(&tb->tb6_lock)->rlock){+.-.}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:315 [inline]
__ip6_ins_rt+0x56/0x90 net/ipv6/route.c:1007
ip6_route_add+0x141/0x190 net/ipv6/route.c:2955
addrconf_prefix_route+0x44f/0x620 net/ipv6/addrconf.c:2359
fixup_permanent_addr net/ipv6/addrconf.c:3368 [inline]
addrconf_permanent_addr net/ipv6/addrconf.c:3391 [inline]
addrconf_notify+0x1ad2/0x2310 net/ipv6/addrconf.c:3460
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x15d/0x430 net/core/dev.c:6958
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
do_setlink+0xa22/0x3bb0 net/core/rtnetlink.c:2357
rtnl_newlink+0xf37/0x1a50 net/core/rtnetlink.c:2965
rtnetlink_rcv_msg+0x57f/0xb10 net/core/rtnetlink.c:4641
netlink_rcv_skb+0x14b/0x380 net/netlink/af_netlink.c:2444
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4659
netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline]
netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:639
___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
__sys_sendmsg+0xe5/0x210 net/socket.c:2081
SYSC_sendmsg net/socket.c:2092 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2088
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
-> #0 (&ndev->lock){++--}:
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312
__ipv6_dev_mc_dec+0x45/0x350 net/ipv6/mcast.c:928
ipv6_dev_mc_dec+0x110/0x1f0 net/ipv6/mcast.c:961
pndisc_destructor+0x21a/0x340 net/ipv6/ndisc.c:392
pneigh_ifdown net/core/neighbour.c:695 [inline]
neigh_ifdown+0x149/0x250 net/core/neighbour.c:294
rt6_disable_ip+0x537/0x700 net/ipv6/route.c:3874
addrconf_ifdown+0x14b/0x14f0 net/ipv6/addrconf.c:3633
addrconf_notify+0x5f8/0x2310 net/ipv6/addrconf.c:3557
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x262/0x430 net/core/dev.c:6960
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
devinet_ioctl+0x126a/0x1ac0 net/ipv4/devinet.c:1080
inet_ioctl+0x184/0x310 net/ipv4/af_inet.c:919
packet_ioctl+0x1ff/0x310 net/packet/af_packet.c:4066
sock_do_ioctl+0xef/0x390 net/socket.c:957
sock_ioctl+0x36b/0x610 net/socket.c:1081
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
other info that might help us debug this:
Chain exists of:
&ndev->lock --> rt6_exception_lock --> &tbl->lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&tbl->lock);
lock(rt6_exception_lock);
lock(&tbl->lock);
lock(&ndev->lock);
*** DEADLOCK ***
2 locks held by syz-executor7/4015:
#0: (rtnl_mutex){+.+.}, at: [<00000000a2f16daa>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:74
#1: (&tbl->lock){++-.}, at: [<00000000b5cb1d65>] neigh_ifdown+0x3d/0x250 net/core/neighbour.c:292
stack backtrace:
CPU: 0 PID: 4015 Comm: syz-executor7 Not tainted 4.16.0-rc4+ #277
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
print_circular_bug.isra.38+0x2cd/0x2dc kernel/locking/lockdep.c:1223
check_prev_add kernel/locking/lockdep.c:1863 [inline]
check_prevs_add kernel/locking/lockdep.c:1976 [inline]
validate_chain kernel/locking/lockdep.c:2417 [inline]
__lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3431
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312
__ipv6_dev_mc_dec+0x45/0x350 net/ipv6/mcast.c:928
ipv6_dev_mc_dec+0x110/0x1f0 net/ipv6/mcast.c:961
pndisc_destructor+0x21a/0x340 net/ipv6/ndisc.c:392
pneigh_ifdown net/core/neighbour.c:695 [inline]
neigh_ifdown+0x149/0x250 net/core/neighbour.c:294
rt6_disable_ip+0x537/0x700 net/ipv6/route.c:3874
addrconf_ifdown+0x14b/0x14f0 net/ipv6/addrconf.c:3633
addrconf_notify+0x5f8/0x2310 net/ipv6/addrconf.c:3557
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x262/0x430 net/core/dev.c:6960
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
devinet_ioctl+0x126a/0x1ac0 net/ipv4/devinet.c:1080
inet_ioctl+0x184/0x310 net/ipv4/af_inet.c:919
packet_ioctl+0x1ff/0x310 net/packet/af_packet.c:4066
sock_do_ioctl+0xef/0x390 net/socket.c:957
sock_ioctl+0x36b/0x610 net/socket.c:1081
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
Fixes: c757faa8bfa2 ("ipv6: prepare fib6_age() for exception table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Wei Wang <weiwan@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
---
net/ipv6/route.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b0d5c64e19780ce94feb112285ed1d85dbe07e9e..b33d057ac5eb2a85e19be59f0bceacf547cc9e59 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1626,11 +1626,10 @@ static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket,
struct neighbour *neigh;
__u8 neigh_flags = 0;
- neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
- if (neigh) {
+ neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
+ if (neigh)
neigh_flags = neigh->flags;
- neigh_release(neigh);
- }
+
if (!(neigh_flags & NTF_ROUTER)) {
RT6_TRACE("purging route %p via non-router but gateway\n",
rt);
@@ -1654,7 +1653,8 @@ void rt6_age_exceptions(struct rt6_info *rt,
if (!rcu_access_pointer(rt->rt6i_exception_bucket))
return;
- spin_lock_bh(&rt6_exception_lock);
+ rcu_read_lock_bh();
+ spin_lock(&rt6_exception_lock);
bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
lockdep_is_held(&rt6_exception_lock));
@@ -1668,7 +1668,8 @@ void rt6_age_exceptions(struct rt6_info *rt,
bucket++;
}
}
- spin_unlock_bh(&rt6_exception_lock);
+ spin_unlock(&rt6_exception_lock);
+ rcu_read_unlock_bh();
}
struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
--
2.17.0.rc0.231.g781580f067-goog
^ permalink raw reply related
* Re: [bpf-next V5 PATCH 11/15] page_pool: refurbish version of page_pool code
From: Eric Dumazet @ 2018-03-23 14:55 UTC (permalink / raw)
To: Jesper Dangaard Brouer, Eric Dumazet
Cc: netdev, BjörnTöpel, magnus.karlsson, eugenia,
Jason Wang, John Fastabend, Eran Ben Elisha, Saeed Mahameed, galp,
Daniel Borkmann, Alexei Starovoitov, Tariq Toukan
In-Reply-To: <20180323151522.2d3dde07@redhat.com>
On 03/23/2018 07:15 AM, Jesper Dangaard Brouer wrote:
> On Fri, 23 Mar 2018 06:29:55 -0700
> Eric Dumazet <eric.dumazet@gmail.com> wrote:
>
>> On 03/23/2018 05:18 AM, Jesper Dangaard Brouer wrote:
>>
>>> +
>>> +void page_pool_destroy_rcu(struct page_pool *pool)
>>> +{
>>> + call_rcu(&pool->rcu, __page_pool_destroy_rcu);
>>> +}
>>> +EXPORT_SYMBOL(page_pool_destroy_rcu);
>>>
>>
>>
>> Why do we need to respect one rcu grace period before destroying a page pool ?
>
> Due to previous allocator ID patch, which can have a pointer reference
> to a page_pool, and the allocator ID lookup uses RCU.
>
I am not convinced. How comes a patch that is _before_ this one can have any impact ?
Normally, we put first infrastructure, then something using it.
rcu grace period before freeing huge quantitites of pages is problematic and could
be used by syzbot to OOM the host.
^ permalink raw reply
* [PATCH v2] fsl/fman: remove unnecessary set_dma_ops() call and HAS_DMA dependency
From: Madalin Bucur @ 2018-03-23 14:52 UTC (permalink / raw)
To: davem, geert.uytterhoeven; +Cc: netdev, linux-kernel, Madalin Bucur
The platform device is no longer used for DMA mapping so the
(questionable) setting of the DMA ops done here is no longer
needed. Removing it together with the HAS_DMA dependency that
it required.
Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
---
drivers/net/ethernet/freescale/fman/Kconfig | 1 -
drivers/net/ethernet/freescale/fman/mac.c | 1 -
2 files changed, 2 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fman/Kconfig b/drivers/net/ethernet/freescale/fman/Kconfig
index 8870a9a..dc0850b 100644
--- a/drivers/net/ethernet/freescale/fman/Kconfig
+++ b/drivers/net/ethernet/freescale/fman/Kconfig
@@ -2,7 +2,6 @@ config FSL_FMAN
tristate "FMan support"
depends on FSL_SOC || ARCH_LAYERSCAPE || COMPILE_TEST
select GENERIC_ALLOCATOR
- depends on HAS_DMA
select PHYLIB
default n
help
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 4829dcd..7b5b95f 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -567,7 +567,6 @@ static struct platform_device *dpaa_eth_add_device(int fman_id,
}
pdev->dev.parent = priv->dev;
- set_dma_ops(&pdev->dev, get_dma_ops(priv->dev));
ret = platform_device_add_data(pdev, &data, sizeof(data));
if (ret)
--
2.1.0
^ permalink raw reply related
* Re: [patch net-next RFC 04/12] dsa: set devlink port attrs for dsa ports
From: Jiri Pirko @ 2018-03-23 14:49 UTC (permalink / raw)
To: Andrew Lunn
Cc: netdev, davem, idosch, jakub.kicinski, mlxsw, vivien.didelot,
f.fainelli, michael.chan, ganeshgr, saeedm, simon.horman,
pieter.jansenvanvuuren, john.hurley, dirk.vandermerwe,
alexander.h.duyck, ogerlitz, dsahern, vijaya.guvva,
satananda.burla, raghu.vatsavayi, felix.manlunas, gospo,
sathya.perla, vasundhara-v.volam, tariqt, eranbe,
jeffrey.t.kirsher
In-Reply-To: <20180323133002.GF5145@lunn.ch>
Fri, Mar 23, 2018 at 02:30:02PM CET, andrew@lunn.ch wrote:
>On Thu, Mar 22, 2018 at 11:55:14AM +0100, Jiri Pirko wrote:
>> From: Jiri Pirko <jiri@mellanox.com>
>>
>> Set the attrs and allow to expose port flavour to user via devlink.
>>
>> Signed-off-by: Jiri Pirko <jiri@mellanox.com>
>> ---
>> net/dsa/dsa2.c | 23 +++++++++++++++++++++++
>> 1 file changed, 23 insertions(+)
>>
>> diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
>> index adf50fbc4c13..49453690696d 100644
>> --- a/net/dsa/dsa2.c
>> +++ b/net/dsa/dsa2.c
>> @@ -270,7 +270,27 @@ static int dsa_port_setup(struct dsa_port *dp)
>> case DSA_PORT_TYPE_UNUSED:
>> break;
>> case DSA_PORT_TYPE_CPU:
>> + /* dp->index is used now as port_number. However
>> + * CPU ports should have separate numbering
>> + * independent from front panel port numbers.
>> + */
>> + devlink_port_attrs_set(&dp->devlink_port,
>> + DEVLINK_PORT_FLAVOUR_CPU,
>> + dp->index, false, 0);
>> + err = dsa_port_link_register_of(dp);
>> + if (err) {
>> + dev_err(ds->dev, "failed to setup link for port %d.%d\n",
>> + ds->index, dp->index);
>> + return err;
>> + }
>
>Ah, i get it. These used to be two case statements with one code
>block. But you split them apart, so needed to duplicate the
>dsa_port_link_register.
>
>Unfortunately, you forgot to add a 'break;', so it still falls
>through, and overwrites the port flavour to DSA.
ah, crap. Don't have hw to test this :/
Will fix. Thanks!
>
>> case DSA_PORT_TYPE_DSA:
>> + /* dp->index is used now as port_number. However
>> + * DSA ports should have separate numbering
>> + * independent from front panel port numbers.
>> + */
>> + devlink_port_attrs_set(&dp->devlink_port,
>> + DEVLINK_PORT_FLAVOUR_DSA,
>> + dp->index, false, 0);
>
> Andrew
^ permalink raw reply
* Re: [net-next:master 304/314] drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3878:8: error: too few arguments to function 'devlink_resource_register'
From: David Ahern @ 2018-03-23 14:33 UTC (permalink / raw)
To: Jiri Pirko; +Cc: kbuild test robot, kbuild-all, netdev
In-Reply-To: <20180323065310.GN2074@nanopsycho.orion>
On 3/23/18 12:53 AM, Jiri Pirko wrote:
> Fri, Mar 23, 2018 at 02:53:38AM CET, dsahern@gmail.com wrote:
>> On 3/22/18 6:47 PM, kbuild test robot wrote:
>>> tree: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
>>> head: 6686c459e1449a3ee5f3fd313b0a559ace7a700e
>>> commit: 145307460ba9c11489807de7acd3f4c7395f60b7 [304/314] devlink: Remove top_hierarchy arg to devlink_resource_register
>>> config: x86_64-randconfig-s1-03230751 (attached as .config)
>>> compiler: gcc-6 (Debian 6.4.0-9) 6.4.0 20171026
>>> reproduce:
>>> git checkout 145307460ba9c11489807de7acd3f4c7395f60b7
>>> # save the attached .config to linux build tree
>>> make ARCH=x86_64
>>>
>>> All error/warnings (new ones prefixed by >>):
>>>
>>> drivers/net/ethernet/mellanox/mlxsw/spectrum.c: In function 'mlxsw_sp_resources_register':
>>>>> drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3881:6: warning: passing argument 6 of 'devlink_resource_register' makes integer from pointer without a cast [-Wint-conversion]
>>> &kvd_size_params,
>>> ^
>>> In file included from drivers/net/ethernet/mellanox/mlxsw/core.h:47:0,
>>> from drivers/net/ethernet/mellanox/mlxsw/spectrum.h:54,
>>> from drivers/net/ethernet/mellanox/mlxsw/spectrum.c:64:
>>> include/net/devlink.h:560:1: note: expected 'u64 {aka long long unsigned int}' but argument is of type 'struct devlink_resource_size_params *'
>>> devlink_resource_register(struct devlink *devlink,
>>> ^~~~~~~~~~~~~~~~~~~~~~~~~
>>
>> I just did another full build (allmodconfig) on net-next and did not hit
>> this error.
>
> The "else branch" in "#if IS_ENABLED(CONFIG_NET_DEVLINK)" is the
> problem:
>
> static inline int
> devlink_resource_register(struct devlink *devlink,
> const char *resource_name,
> bool top_hierarchy,
> u64 resource_size,
> u64 resource_id,
> u64 parent_resource_id,
> const struct devlink_resource_size_params *size_params,
> const struct devlink_resource_ops *resource_ops)
> {
> return 0;
> }
>
ugh. Thanks, Jiri. Will fix.
^ permalink raw reply
* [PATCH net] udp6: set dst cache for a connected sk before udp_v6_send_skb
From: Alexey Kodanev @ 2018-03-23 14:39 UTC (permalink / raw)
To: netdev; +Cc: David Miller, Alexey Kodanev
After commit 33c162a980fe ("ipv6: datagram: Update dst cache of a
connected datagram sk during pmtu update"), when the error occurs on
sending datagram in udpv6_sendmsg() due to ICMPV6_PKT_TOOBIG type,
error handler can trigger the following path and call ip6_dst_store():
udpv6_err()
ip6_sk_update_pmtu()
ip6_datagram_dst_update()
ip6_dst_lookup_flow(), can create a RTF_CACHE clone
...
ip6_dst_store()
It can happen before a connected UDP socket invokes ip6_dst_store()
in the end of udpv6_sendmsg(), on destination release, as a result,
the last one changes dst to the old one, preventing getting updated
dst cache on the next udpv6_sendmsg() call.
This patch moves ip6_dst_store() in udpv6_sendmsg(), so that it is
invoked after ip6_sk_dst_lookup_flow() and before udp_v6_send_skb().
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
---
net/ipv6/udp.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 52e3ea0..0d413c6 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1299,6 +1299,16 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
if (ipc6.hlimit < 0)
ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
+ if (connected)
+ ip6_dst_store(sk, dst,
+ ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
+ &sk->sk_v6_daddr : NULL,
+#ifdef CONFIG_IPV6_SUBTREES
+ ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
+ &np->saddr :
+#endif
+ NULL);
+
if (msg->msg_flags&MSG_CONFIRM)
goto do_confirm;
back_from_confirm:
@@ -1350,18 +1360,8 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
release_dst:
if (dst) {
- if (connected) {
- ip6_dst_store(sk, dst,
- ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
- &sk->sk_v6_daddr : NULL,
-#ifdef CONFIG_IPV6_SUBTREES
- ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
- &np->saddr :
-#endif
- NULL);
- } else {
+ if (!connected)
dst_release(dst);
- }
dst = NULL;
}
--
1.8.3.1
^ permalink raw reply related
* Re: [PATCH RFC net-next 7/7] netdevsim: Add simple FIB resource controller via devlink
From: David Ahern @ 2018-03-23 14:31 UTC (permalink / raw)
To: Jiri Pirko
Cc: netdev, davem, roopa, shm, jiri, idosch, jakub.kicinski,
David Ahern
In-Reply-To: <20180323065010.GM2074@nanopsycho.orion>
On 3/23/18 12:50 AM, Jiri Pirko wrote:
>> +void nsim_devlink_setup(struct netdevsim *ns)
>> +{
>> + struct net *net = dev_net(ns->netdev);
>> + bool *reg_devlink = net_generic(net, nsim_devlink_id);
>> + struct devlink *devlink;
>> + int err = -ENOMEM;
>> +
>> + /* only one device per namespace controls devlink */
>> + if (!*reg_devlink) {
>> + ns->devlink = NULL;
>> + return;
>> + }
>> +
>> + devlink = devlink_alloc(&nsim_devlink_ops, 0);
>> + if (!devlink)
>> + return;
>> +
>> + devlink_net_set(devlink, net);
>> + err = devlink_register(devlink, &ns->dev);
>
> This reg_devlink construct looks odd. Why don't you leave the devlink
> instance in init_ns?
It is a per-network namespace resource controller. Since struct devlink
has a net entry, the simplest design is to put it into the namespace of
the controller. Without it, controlling resource sizes in namespace
'foobar' has to be done from init_net, which is just wrong.
^ permalink raw reply
* [PATCH] of_net: Implement of_get_nvmem_mac_address helper
From: Mike Looijmans @ 2018-03-23 14:24 UTC (permalink / raw)
To: netdev
Cc: linux-kernel, devicetree, andrew, f.fainelli, robh+dt,
frowand.list, Mike Looijmans
It's common practice to store MAC addresses for network interfaces into
nvmem devices. However the code to actually do this in the kernel lacks,
so this patch adds of_get_nvmem_mac_address() for drivers to obtain the
address from an nvmem cell provider.
This is particulary useful on devices where the ethernet interface cannot
be configured by the bootloader, for example because it's in an FPGA.
Tested by adapting the cadence macb driver to call this instead of
of_get_mac_address().
Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
---
drivers/of/of_net.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
include/linux/of_net.h | 6 ++++++
2 files changed, 54 insertions(+)
diff --git a/drivers/of/of_net.c b/drivers/of/of_net.c
index d820f3e..316a537 100644
--- a/drivers/of/of_net.c
+++ b/drivers/of/of_net.c
@@ -7,6 +7,7 @@
*/
#include <linux/etherdevice.h>
#include <linux/kernel.h>
+#include <linux/nvmem-consumer.h>
#include <linux/of_net.h>
#include <linux/phy.h>
#include <linux/export.h>
@@ -80,3 +81,50 @@ const void *of_get_mac_address(struct device_node *np)
return of_get_mac_addr(np, "address");
}
EXPORT_SYMBOL(of_get_mac_address);
+
+/**
+ * Search the device tree for a MAC address, by calling of_get_mac_address
+ * and if that doesn't provide an address, fetch it from an nvmem provider
+ * using the name 'mac-address'.
+ * On success, copies the new address is into memory pointed to by addr and
+ * returns 0. Returns a negative error code otherwise.
+ * @dev: Pointer to the device containing the device_node
+ * @addr: Pointer to receive the MAC address using ether_addr_copy()
+ */
+int of_get_nvmem_mac_address(struct device *dev, char *addr)
+{
+ const char *mac;
+ struct nvmem_cell *cell;
+ size_t len;
+ int ret;
+
+ mac = of_get_mac_address(dev->of_node);
+ if (mac) {
+ ether_addr_copy(addr, mac);
+ return 0;
+ }
+
+ cell = nvmem_cell_get(dev, "mac-address");
+ if (IS_ERR(cell))
+ return PTR_ERR(cell);
+
+ mac = (const char *)nvmem_cell_read(cell, &len);
+
+ nvmem_cell_put(cell);
+
+ if (IS_ERR(mac))
+ return PTR_ERR(mac);
+
+ if (len < 6 || !is_valid_ether_addr(mac)) {
+ dev_err(dev, "MAC address from NVMEM is invalid\n");
+ ret = -EINVAL;
+ } else {
+ ether_addr_copy(addr, mac);
+ ret = 0;
+ }
+
+ kfree(mac);
+
+ return ret;
+}
+EXPORT_SYMBOL(of_get_nvmem_mac_address);
diff --git a/include/linux/of_net.h b/include/linux/of_net.h
index 9cd72aa..0d52e1d 100644
--- a/include/linux/of_net.h
+++ b/include/linux/of_net.h
@@ -13,6 +13,7 @@
struct net_device;
extern int of_get_phy_mode(struct device_node *np);
extern const void *of_get_mac_address(struct device_node *np);
+extern int of_get_nvmem_mac_address(struct device *dev, char *addr);
extern struct net_device *of_find_net_device_by_node(struct device_node *np);
#else
static inline int of_get_phy_mode(struct device_node *np)
@@ -25,6 +26,11 @@ static inline const void *of_get_mac_address(struct device_node *np)
return NULL;
}
+static inline int of_get_nvmem_mac_address(struct device *dev, char *addr)
+{
+ return -ENODEV;
+}
+
static inline struct net_device *of_find_net_device_by_node(struct device_node *np)
{
return NULL;
--
1.9.1
^ permalink raw reply related
* Re: linux-next: manual merge of the net-next tree with the rdma-fixes tree
From: David Miller @ 2018-03-23 14:22 UTC (permalink / raw)
To: jgg; +Cc: dledford, sfr, netdev, linux-next, linux-kernel, markb, leonro
In-Reply-To: <20180323043315.GB13185@mellanox.com>
From: Jason Gunthorpe <jgg@mellanox.com>
Date: Thu, 22 Mar 2018 22:33:15 -0600
> Doug and I moved to a shared repo location when we started maintain it
> as a team:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git
>
> The commit is here:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=for-next&id=2d873449a202d02e0c4d90009fb2beb7013ac575
Thanks a lot.
^ permalink raw reply
* Re: [bpf-next V5 PATCH 11/15] page_pool: refurbish version of page_pool code
From: Jesper Dangaard Brouer @ 2018-03-23 14:15 UTC (permalink / raw)
To: Eric Dumazet
Cc: netdev, BjörnTöpel, magnus.karlsson, eugenia,
Jason Wang, John Fastabend, Eran Ben Elisha, Saeed Mahameed, galp,
Daniel Borkmann, Alexei Starovoitov, Tariq Toukan, brouer
In-Reply-To: <b8463e12-d1eb-d862-c5f4-09fc0ac33382@gmail.com>
On Fri, 23 Mar 2018 06:29:55 -0700
Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On 03/23/2018 05:18 AM, Jesper Dangaard Brouer wrote:
>
> > +
> > +void page_pool_destroy_rcu(struct page_pool *pool)
> > +{
> > + call_rcu(&pool->rcu, __page_pool_destroy_rcu);
> > +}
> > +EXPORT_SYMBOL(page_pool_destroy_rcu);
> >
>
>
> Why do we need to respect one rcu grace period before destroying a page pool ?
Due to previous allocator ID patch, which can have a pointer reference
to a page_pool, and the allocator ID lookup uses RCU.
> In any case, this should be called page_pool_destroy()
Okay.
--
Best regards,
Jesper Dangaard Brouer
MSc.CS, Principal Kernel Engineer at Red Hat
LinkedIn: http://www.linkedin.com/in/brouer
^ permalink raw reply
* Re: [QUESTION] Mainline support for B43_PHY_AC wifi cards
From: Juri Lelli @ 2018-03-23 14:09 UTC (permalink / raw)
To: Rafał Miłecki
Cc: b43-dev, Network Development, linux-wireless@vger.kernel.org,
Linux Kernel Mailing List
In-Reply-To: <CACna6rx-QNQhVNkwFSabwAY9vM1qV_gTcWywsHFuP5B4NH4NXA@mail.gmail.com>
Hi,
thanks a lot for your reply!
On 23/03/18 14:43, Rafał Miłecki wrote:
> Hi,
>
> On 23 March 2018 at 10:47, Juri Lelli <juri.lelli@gmail.com> wrote:
> > I've got a Dell XPS 13 9343/0TM99H (BIOS A15 01/23/2018) mounting a
> > BCM4352 802.11ac (rev 03) wireless card and so far I've been using it on
> > Fedora with broadcom-wl package (which I believe installs Broadcom's STA
> > driver?). It works good apart from occasional hiccups after suspend.
> >
> > I'd like to get rid of that dependency (you can understand that it's
> > particularly annoying when testing mainline kernels), but I found out
> > that support for my card is BROKEN in mainline [1]. Just to see what
> > happens, I forcibly enabled it witnessing that it indeed crashes like
> > below as Kconfig warns. :)
> >
> > bcma: bus0: Found chip with id 0x4352, rev 0x03 and package 0x00
> > bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x2B, class 0x0)
> > bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x2A, class 0x0)
> > bcma: bus0: Core 2 found: ARM CR4 (manuf 0x4BF, id 0x83E, rev 0x02, class 0x0)
> > bcma: bus0: Core 3 found: PCIe Gen2 (manuf 0x4BF, id 0x83C, rev 0x01, class 0x0)
> > bcma: bus0: Core 4 found: USB 2.0 Device (manuf 0x4BF, id 0x81A, rev 0x11, class 0x0)
> > bcma: Unsupported SPROM revision: 11
> > bcma: bus0: Invalid SPROM read from the PCIe card, trying to use fallback SPROM
> > bcma: bus0: Using fallback SPROM failed (err -2)
> > bcma: bus0: No SPROM available
> > bcma: bus0: Bus registered
> > b43-phy0: Broadcom 4352 WLAN found (core revision 42)
> > b43-phy0: Found PHY: Analog 12, Type 11 (AC), Revision 1
> > b43-phy0: Found Radio: Manuf 0x17F, ID 0x2069, Revision 4, Version 0
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
>
> This isn't really useful without a full backtrace.
Sure. I cut it here because I didn't expect people to debug what is
already known to be broken (but still it seemed to carry useful
information about the hw). :)
> > So, question: is replacing my card the only way I can get rid of this
> > downstream dependency? :(
>
> It's definitely the cheapest way. Getting AC PHY into anything usable
> (proper setup that will allow Tx & Rx anything) would probably take
> weeks or months of development. I'm not even going to estimate cost of
> adding support for 802.11n and 802.11ac features. I was the last
> person actively working on b43, right now I spend my free time on
> other hobby projects. Few people were planning to help but it seems it
> never worked out for them.
I see. Just wondering why even if Broadcom's STA solution seems to work
fine, it is not mainline. Maybe a maintenance problem? But Fedora ships
with very recent kernels, so I'd expect the driver to work with mainline
(I tried compiling that against mainline, but I got errors that I didn't
spend time figuring out how to fix).
Do you know what's the deal w.r.t. the STA driver?
Best,
- Juri
^ permalink raw reply
* Re: [PATCH net v2] ipv6: the entire IPv6 header chain must fit the first fragment
From: Eric Dumazet @ 2018-03-23 14:04 UTC (permalink / raw)
To: Paolo Abeni, netdev; +Cc: David S. Miller, David Ahern, syzbot, syzkaller-bugs
In-Reply-To: <43638c155545c57a4b332c64771a1e9b0238148c.1521812678.git.pabeni@redhat.com>
On 03/23/2018 06:47 AM, Paolo Abeni wrote:
> While building ipv6 datagram we currently allow arbitrary large
> extheaders, even beyond pmtu size. The syzbot has found a way
> to exploit the above to trigger the following splat:
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Thanks Paolo !
^ permalink raw reply
* [iproute2 1/1] ss: Add support for TIPC socket diag in ss tool
From: GhantaKrishnamurthy MohanKrishna @ 2018-03-23 14:01 UTC (permalink / raw)
To: tipc-discussion, jon.maloy, maloy, ying.xue,
mohan.krishna.ghanta.krishnamurthy, netdev, stephen
Cc: Parthasarathy Bhuvaragan
In-Reply-To: <1521813662-9954-1-git-send-email-mohan.krishna.ghanta.krishnamurthy@ericsson.com>
For iproute 4.x
Allow TIPC socket statistics to be dumped with --tipc
and tipc specific info with --tipcinfo.
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: GhantaKrishnamurthy MohanKrishna <mohan.krishna.ghanta.krishnamurthy@ericsson.com>
Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@gmail.com>
---
misc/ss.c | 166 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 164 insertions(+), 2 deletions(-)
diff --git a/misc/ss.c b/misc/ss.c
index e047f9c04582..812f45717af9 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -45,6 +45,10 @@
#include <linux/netlink_diag.h>
#include <linux/sctp.h>
#include <linux/vm_sockets_diag.h>
+#include <linux/net.h>
+#include <linux/tipc.h>
+#include <linux/tipc_netlink.h>
+#include <linux/tipc_sockets_diag.h>
#define MAGIC_SEQ 123456
#define BUF_CHUNK (1024 * 1024)
@@ -104,6 +108,7 @@ int show_sock_ctx;
int show_header = 1;
int follow_events;
int sctp_ino;
+int show_tipcinfo;
enum col_id {
COL_NETID,
@@ -191,6 +196,7 @@ enum {
SCTP_DB,
VSOCK_ST_DB,
VSOCK_DG_DB,
+ TIPC_DB,
MAX_DB
};
@@ -230,6 +236,7 @@ enum {
#define SS_ALL ((1 << SS_MAX) - 1)
#define SS_CONN (SS_ALL & ~((1<<SS_LISTEN)|(1<<SS_CLOSE)|(1<<SS_TIME_WAIT)|(1<<SS_SYN_RECV)))
+#define TIPC_SS_CONN ((1<<SS_ESTABLISHED)|(1<<SS_LISTEN)|(1<<SS_CLOSE))
#include "ssfilter.h"
@@ -297,6 +304,10 @@ static const struct filter default_dbs[MAX_DB] = {
.states = SS_CONN,
.families = FAMILY_MASK(AF_VSOCK),
},
+ [TIPC_DB] = {
+ .states = TIPC_SS_CONN,
+ .families = FAMILY_MASK(AF_TIPC),
+ },
};
static const struct filter default_afs[AF_MAX] = {
@@ -324,6 +335,10 @@ static const struct filter default_afs[AF_MAX] = {
.dbs = VSOCK_DBM,
.states = SS_CONN,
},
+ [AF_TIPC] = {
+ .dbs = (1 << TIPC_DB),
+ .states = TIPC_SS_CONN,
+ },
};
static int do_default = 1;
@@ -364,6 +379,7 @@ static void filter_default_dbs(struct filter *f)
filter_db_set(f, SCTP_DB);
filter_db_set(f, VSOCK_ST_DB);
filter_db_set(f, VSOCK_DG_DB);
+ filter_db_set(f, TIPC_DB);
}
static void filter_states_set(struct filter *f, int states)
@@ -748,6 +764,14 @@ static const char *sctp_sstate_name[] = {
[SCTP_STATE_SHUTDOWN_ACK_SENT] = "ACK_SENT",
};
+static const char * const stype_nameg[] = {
+ "UNKNOWN",
+ [SOCK_STREAM] = "STREAM",
+ [SOCK_DGRAM] = "DGRAM",
+ [SOCK_RDM] = "RDM",
+ [SOCK_SEQPACKET] = "SEQPACKET",
+};
+
struct sockstat {
struct sockstat *next;
unsigned int type;
@@ -888,6 +912,22 @@ static const char *vsock_netid_name(int type)
}
}
+static const char *tipc_netid_name(int type)
+{
+ switch (type) {
+ case SOCK_STREAM:
+ return "ti_st";
+ case SOCK_DGRAM:
+ return "ti_dg";
+ case SOCK_RDM:
+ return "ti_rd";
+ case SOCK_SEQPACKET:
+ return "ti_sq";
+ default:
+ return "???";
+ }
+}
+
/* Allocate and initialize a new buffer chunk */
static struct buf_chunk *buf_chunk_new(void)
{
@@ -1274,6 +1314,9 @@ static void sock_state_print(struct sockstat *s)
case AF_NETLINK:
sock_name = "nl";
break;
+ case AF_TIPC:
+ sock_name = tipc_netid_name(s->type);
+ break;
case AF_VSOCK:
sock_name = vsock_netid_name(s->type);
break;
@@ -4250,6 +4293,105 @@ static int vsock_show(struct filter *f)
return handle_netlink_request(f, &req.nlh, sizeof(req), vsock_show_sock);
}
+static void tipc_sock_addr_print(struct rtattr *net_addr, struct rtattr *id)
+{
+ uint32_t node = rta_getattr_u32(net_addr);
+ uint32_t identity = rta_getattr_u32(id);
+
+ SPRINT_BUF(addr) = {};
+ SPRINT_BUF(port) = {};
+
+ sprintf(addr, "%u", node);
+ sprintf(port, "%u", identity);
+ sock_addr_print(addr, ":", port, NULL);
+
+}
+
+static int tipc_show_sock(const struct sockaddr_nl *addr, struct nlmsghdr *nlh,
+ void *arg)
+{
+ struct rtattr *stat[TIPC_NLA_SOCK_STAT_MAX + 1] = {};
+ struct rtattr *attrs[TIPC_NLA_SOCK_MAX + 1] = {};
+ struct rtattr *con[TIPC_NLA_CON_MAX + 1] = {};
+ struct rtattr *info[TIPC_NLA_MAX + 1] = {};
+ struct rtattr *msg_ref;
+ struct sockstat ss = {};
+
+ parse_rtattr(info, TIPC_NLA_MAX, NLMSG_DATA(nlh),
+ NLMSG_PAYLOAD(nlh, 0));
+
+ if (!info[TIPC_NLA_SOCK])
+ return 0;
+
+ msg_ref = info[TIPC_NLA_SOCK];
+ parse_rtattr(attrs, TIPC_NLA_SOCK_MAX, RTA_DATA(msg_ref),
+ RTA_PAYLOAD(msg_ref));
+
+ msg_ref = attrs[TIPC_NLA_SOCK_STAT];
+ parse_rtattr(stat, TIPC_NLA_SOCK_STAT_MAX,
+ RTA_DATA(msg_ref), RTA_PAYLOAD(msg_ref));
+
+
+ ss.local.family = AF_TIPC;
+ ss.type = rta_getattr_u32(attrs[TIPC_NLA_SOCK_TYPE]);
+ ss.state = rta_getattr_u32(attrs[TIPC_NLA_SOCK_TIPC_STATE]);
+ ss.uid = rta_getattr_u32(attrs[TIPC_NLA_SOCK_UID]);
+ ss.ino = rta_getattr_u32(attrs[TIPC_NLA_SOCK_INO]);
+ ss.rq = rta_getattr_u32(stat[TIPC_NLA_SOCK_STAT_RCVQ]);
+ ss.wq = rta_getattr_u32(stat[TIPC_NLA_SOCK_STAT_SENDQ]);
+ ss.sk = rta_getattr_u64(attrs[TIPC_NLA_SOCK_COOKIE]);
+
+ sock_state_print (&ss);
+
+ tipc_sock_addr_print(attrs[TIPC_NLA_SOCK_ADDR],
+ attrs[TIPC_NLA_SOCK_REF]);
+
+ msg_ref = attrs[TIPC_NLA_SOCK_CON];
+ if (msg_ref) {
+ parse_rtattr(con, TIPC_NLA_CON_MAX,
+ RTA_DATA(msg_ref), RTA_PAYLOAD(msg_ref));
+
+ tipc_sock_addr_print(con[TIPC_NLA_CON_NODE],
+ con[TIPC_NLA_CON_SOCK]);
+ } else
+ sock_addr_print("", "-", "", NULL);
+
+ if (show_details)
+ sock_details_print(&ss);
+
+ proc_ctx_print(&ss);
+
+ if (show_tipcinfo) {
+ out("\n type:%s", stype_nameg[ss.type]);
+ out(" cong:%s ",
+ stat[TIPC_NLA_SOCK_STAT_LINK_CONG] ? "link" :
+ stat[TIPC_NLA_SOCK_STAT_CONN_CONG] ? "conn" : "none");
+ out(" drop:%d ",
+ rta_getattr_u32(stat[TIPC_NLA_SOCK_STAT_DROP]));
+
+ if (attrs[TIPC_NLA_SOCK_HAS_PUBL])
+ out(" publ");
+
+ if (con[TIPC_NLA_CON_FLAG])
+ out(" via {%u,%u} ",
+ rta_getattr_u32(con[TIPC_NLA_CON_TYPE]),
+ rta_getattr_u32(con[TIPC_NLA_CON_INST]));
+ }
+
+ return 0;
+}
+
+static int tipc_show(struct filter *f)
+{
+ DIAG_REQUEST(req, struct tipc_sock_diag_req r);
+
+ memset(&req.r, 0, sizeof(req.r));
+ req.r.sdiag_family = AF_TIPC;
+ req.r.tidiag_states = f->states;
+
+ return handle_netlink_request(f, &req.nlh, sizeof(req), tipc_show_sock);
+}
+
struct sock_diag_msg {
__u8 sdiag_family;
};
@@ -4494,6 +4636,7 @@ static void _usage(FILE *dest)
" -m, --memory show socket memory usage\n"
" -p, --processes show process using socket\n"
" -i, --info show internal TCP information\n"
+" --tipcinfo show internal tipc socket information\n"
" -s, --summary show socket usage summary\n"
" -b, --bpf show bpf filter socket information\n"
" -E, --events continually display sockets as they are destroyed\n"
@@ -4510,15 +4653,16 @@ static void _usage(FILE *dest)
" -d, --dccp display only DCCP sockets\n"
" -w, --raw display only RAW sockets\n"
" -x, --unix display only Unix domain sockets\n"
+" --tipc display only TIPC sockets\n"
" --vsock display only vsock sockets\n"
" -f, --family=FAMILY display sockets of type FAMILY\n"
-" FAMILY := {inet|inet6|link|unix|netlink|vsock|help}\n"
+" FAMILY := {inet|inet6|link|unix|netlink|vsock|tipc|help}\n"
"\n"
" -K, --kill forcibly close sockets, display what was closed\n"
" -H, --no-header Suppress header line\n"
"\n"
" -A, --query=QUERY, --socket=QUERY\n"
-" QUERY := {all|inet|tcp|udp|raw|unix|unix_dgram|unix_stream|unix_seqpacket|packet|netlink|vsock_stream|vsock_dgram}[,QUERY]\n"
+" QUERY := {all|inet|tcp|udp|raw|unix|unix_dgram|unix_stream|unix_seqpacket|packet|netlink|vsock_stream|vsock_dgram|tipc}[,QUERY]\n"
"\n"
" -D, --diag=FILE Dump raw information about TCP sockets to FILE\n"
" -F, --filter=FILE read filter information from FILE\n"
@@ -4594,6 +4738,10 @@ static int scan_state(const char *state)
/* Values 'v' and 'V' are already used so a non-character is used */
#define OPT_VSOCK 256
+/* Values of 't' are already used so a non-character is used */
+#define OPT_TIPCSOCK 257
+#define OPT_TIPCINFO 258
+
static const struct option long_opts[] = {
{ "numeric", 0, 0, 'n' },
{ "resolve", 0, 0, 'r' },
@@ -4610,6 +4758,7 @@ static const struct option long_opts[] = {
{ "udp", 0, 0, 'u' },
{ "raw", 0, 0, 'w' },
{ "unix", 0, 0, 'x' },
+ { "tipc", 0, 0, OPT_TIPCSOCK},
{ "vsock", 0, 0, OPT_VSOCK },
{ "all", 0, 0, 'a' },
{ "listening", 0, 0, 'l' },
@@ -4627,6 +4776,7 @@ static const struct option long_opts[] = {
{ "context", 0, 0, 'Z' },
{ "contexts", 0, 0, 'z' },
{ "net", 1, 0, 'N' },
+ { "tipcinfo", 0, 0, OPT_TIPCINFO},
{ "kill", 0, 0, 'K' },
{ "no-header", 0, 0, 'H' },
{ 0 }
@@ -4699,6 +4849,9 @@ int main(int argc, char *argv[])
case OPT_VSOCK:
filter_af_set(¤t_filter, AF_VSOCK);
break;
+ case OPT_TIPCSOCK:
+ filter_af_set(¤t_filter, AF_TIPC);
+ break;
case 'a':
state_filter = SS_ALL;
break;
@@ -4725,6 +4878,8 @@ int main(int argc, char *argv[])
filter_af_set(¤t_filter, AF_UNIX);
else if (strcmp(optarg, "netlink") == 0)
filter_af_set(¤t_filter, AF_NETLINK);
+ else if (strcmp(optarg, "tipc") == 0)
+ filter_af_set(¤t_filter, AF_TIPC);
else if (strcmp(optarg, "vsock") == 0)
filter_af_set(¤t_filter, AF_VSOCK);
else if (strcmp(optarg, "help") == 0)
@@ -4801,6 +4956,8 @@ int main(int argc, char *argv[])
} else if (strcmp(p, "vsock_dgram") == 0 ||
strcmp(p, "v_dgr") == 0) {
filter_db_set(¤t_filter, VSOCK_DG_DB);
+ } else if (strcmp(optarg, "tipc") == 0) {
+ filter_db_set(¤t_filter, TIPC_DB);
} else {
fprintf(stderr, "ss: \"%s\" is illegal socket table id\n", p);
usage();
@@ -4848,6 +5005,9 @@ int main(int argc, char *argv[])
if (netns_switch(optarg))
exit(1);
break;
+ case OPT_TIPCINFO:
+ show_tipcinfo = 1;
+ break;
case 'K':
current_filter.kill = 1;
break;
@@ -4979,6 +5139,8 @@ int main(int argc, char *argv[])
sctp_show(¤t_filter);
if (current_filter.dbs & VSOCK_DBM)
vsock_show(¤t_filter);
+ if (current_filter.dbs & (1<<TIPC_DB))
+ tipc_show(¤t_filter);
if (show_users || show_proc_ctx || show_sock_ctx)
user_ent_destroy();
--
2.1.4
^ permalink raw reply related
* [iproute2 0/1] iproute2: add TIPC statistics support in ss
From: GhantaKrishnamurthy MohanKrishna @ 2018-03-23 14:01 UTC (permalink / raw)
To: tipc-discussion, jon.maloy, maloy, ying.xue,
mohan.krishna.ghanta.krishnamurthy, netdev, stephen
The following patchset add user space TIPC socket diagnostics support
in ss tool of iproute2. It requires the sock_diag framework
for AF_TIPC support in the kernel, commit id: c30b70deb5f
(tipc: implement socket diagnostics for AF_TIPC).
tipc socket stats are requested with the "--tipc" option. Additional
tipc specific info are requested with "--tipcinfo" option.
This patchset is based on top of iproute2 v4.15.0-100-g4f63187
commitid: f85adc6. It has been co-authored by
Parthasarathy Bhuvaragan.
Example output (the first socket is the internal topology server)
# tipc-pipe -l 1000 >&/dev/null &
# tipc-pipe --sqp -l 5003 >&/dev/null &
# tipc-pipe --rdm -l 4000 >&/dev/null &
# tipc-pipe 1000 >& /dev/null &
#ss --tipc --extended --processes
#ss --tipc -ep
# ss --tipc --extended --processes
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 16781313:2809484547 - ino:13348 sk:4 users:(("tipc-pipe",pid=292,fd=3))
LISTEN 0 0 16781313:4117673024 - ino:13346 sk:5 users:(("tipc-pipe",pid=291,fd=3))
ESTAB 0 0 16781313:484097386 16781313:3203149317 ino:13345 sk:6 users:(("tipc-pipe",pid=294,fd=4))
LISTEN 0 0 16781313:2438310591 - ino:13344 sk:7 users:(("tipc-pipe",pid=294,fd=3),("tipc-pipe",pid=290,fd=3))
LISTEN 0 0 16781313:2658440413 - ino:12368 sk:3
ESTAB 0 0 16781313:3203149317 16781313:484097386 ino:13349 sk:8 users:(("tipc-pipe",pid=293,fd=3))
#ss --tipc --tipcinfo
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 16781313:2809484547 -
type:RDM cong:none drop:0 publ
LISTEN 0 0 16781313:4117673024 -
type:SEQPACKET cong:none drop:0 publ
ESTAB 0 0 16781313:484097386 16781313:3203149317
type:STREAM cong:none drop:0 via {1000,1000}
LISTEN 0 0 16781313:2438310591 -
type:STREAM cong:none drop:0 publ
LISTEN 0 0 16781313:2658440413 -
type:SEQPACKET cong:none drop:0 publ
ESTAB 0 0 16781313:3203149317 16781313:484097386
type:STREAM cong:none drop:0 via {1000,1000}
GhantaKrishnamurthy MohanKrishna (1):
ss: Add support for TIPC socket diag in ss tool
misc/ss.c | 166 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 164 insertions(+), 2 deletions(-)
--
2.1.4
^ permalink raw reply
* [bpf-next V5 PATCH 00/15] Series short description
From: Jesper Dangaard Brouer @ 2018-03-23 13:55 UTC (permalink / raw)
To: netdev, BjörnTöpel, magnus.karlsson
Cc: eugenia, Jason Wang, John Fastabend, Eran Ben Elisha,
Saeed Mahameed, galp, Jesper Dangaard Brouer, Daniel Borkmann,
Alexei Starovoitov, Tariq Toukan
The following series implements...
---
Jesper Dangaard Brouer (15):
mlx5: basic XDP_REDIRECT forward support
xdp: introduce xdp_return_frame API and use in cpumap
ixgbe: use xdp_return_frame API
xdp: move struct xdp_buff from filter.h to xdp.h
xdp: introduce a new xdp_frame type
tun: convert to use generic xdp_frame and xdp_return_frame API
virtio_net: convert to use generic xdp_frame and xdp_return_frame API
bpf: cpumap convert to use generic xdp_frame
mlx5: register a memory model when XDP is enabled
xdp: rhashtable with allocator ID to pointer mapping
page_pool: refurbish version of page_pool code
xdp: allow page_pool as an allocator type in xdp_return_frame
mlx5: use page_pool for xdp_return_frame call
xdp: transition into using xdp_frame for return API
xdp: transition into using xdp_frame for ndo_xdp_xmit
drivers/net/ethernet/intel/ixgbe/ixgbe.h | 3
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++
drivers/net/ethernet/mellanox/mlx5/core/en.h | 4
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 37 ++
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 42 ++-
drivers/net/tun.c | 60 ++--
drivers/net/virtio_net.c | 52 ++-
drivers/vhost/net.c | 7
include/linux/filter.h | 24 --
include/linux/if_tun.h | 4
include/linux/netdevice.h | 4
include/net/page_pool.h | 133 ++++++++
include/net/xdp.h | 83 +++++
kernel/bpf/cpumap.c | 132 +++-----
net/core/Makefile | 1
net/core/filter.c | 17 +
net/core/page_pool.c | 329 +++++++++++++++++++++
net/core/xdp.c | 257 ++++++++++++++++
18 files changed, 1050 insertions(+), 176 deletions(-)
create mode 100644 include/net/page_pool.h
create mode 100644 net/core/page_pool.c
--
Signature
^ permalink raw reply
* [PATCH net v2] ipv6: the entire IPv6 header chain must fit the first fragment
From: Paolo Abeni @ 2018-03-23 13:47 UTC (permalink / raw)
To: netdev; +Cc: David S. Miller, David Ahern, syzbot, syzkaller-bugs,
Eric Dumazet
While building ipv6 datagram we currently allow arbitrary large
extheaders, even beyond pmtu size. The syzbot has found a way
to exploit the above to trigger the following splat:
kernel BUG at ./include/linux/skbuff.h:2073!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4230 Comm: syzkaller672661 Not tainted 4.16.0-rc2+ #326
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__skb_pull include/linux/skbuff.h:2073 [inline]
RIP: 0010:__ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636
RSP: 0018:ffff8801bc18f0f0 EFLAGS: 00010293
RAX: ffff8801b17400c0 RBX: 0000000000000738 RCX: ffffffff84f01828
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801b415ac18
RBP: ffff8801bc18f360 R08: ffff8801b4576844 R09: 0000000000000000
R10: ffff8801bc18f380 R11: ffffed00367aee4e R12: 00000000000000d6
R13: ffff8801b415a740 R14: dffffc0000000000 R15: ffff8801b45767c0
FS: 0000000001535880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000b000 CR3: 00000001b4123001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ip6_finish_skb include/net/ipv6.h:969 [inline]
udp_v6_push_pending_frames+0x269/0x3b0 net/ipv6/udp.c:1073
udpv6_sendmsg+0x2a96/0x3400 net/ipv6/udp.c:1343
inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:640
___sys_sendmsg+0x320/0x8b0 net/socket.c:2046
__sys_sendmmsg+0x1ee/0x620 net/socket.c:2136
SYSC_sendmmsg net/socket.c:2167 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2162
do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4404c9
RSP: 002b:00007ffdce35f948 EFLAGS: 00000217 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404c9
RDX: 0000000000000003 RSI: 0000000020001f00 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000020000080 R11: 0000000000000217 R12: 0000000000401df0
R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000
Code: ff e8 1d 5e b9 fc e9 15 e9 ff ff e8 13 5e b9 fc e9 44 e8 ff ff e8 29
5e b9 fc e9 c0 e6 ff ff e8 3f f3 80 fc 0f 0b e8 38 f3 80 fc <0f> 0b 49 8d
87 80 00 00 00 4d 8d 87 84 00 00 00 48 89 85 20 fe
RIP: __skb_pull include/linux/skbuff.h:2073 [inline] RSP: ffff8801bc18f0f0
RIP: __ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636 RSP:
ffff8801bc18f0f0
As stated by RFC 7112 section 5:
When a host fragments an IPv6 datagram, it MUST include the entire
IPv6 Header Chain in the First Fragment.
So this patch addresses the issue dropping datagrams with excessive
extheader length. It also updates the error path to report to the
calling socket nonnegative pmtu values.
The issue apparently predates git history.
v1 -> v2: cleanup error path, as per Eric's suggestion
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
net/ipv6/ip6_output.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a8a919520090..5cb18c8ba9b2 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1246,7 +1246,7 @@ static int __ip6_append_data(struct sock *sk,
const struct sockcm_cookie *sockc)
{
struct sk_buff *skb, *skb_prev = NULL;
- unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
+ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
int exthdrlen = 0;
int dst_exthdrlen = 0;
int hh_len;
@@ -1282,6 +1282,12 @@ static int __ip6_append_data(struct sock *sk,
sizeof(struct frag_hdr) : 0) +
rt->rt6i_nfheader_len;
+ /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
+ * the first fragment
+ */
+ if (headersize + transhdrlen > mtu)
+ goto emsgsize;
+
if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
(sk->sk_protocol == IPPROTO_UDP ||
sk->sk_protocol == IPPROTO_RAW)) {
@@ -1297,9 +1303,8 @@ static int __ip6_append_data(struct sock *sk,
if (cork->length + length > maxnonfragsize - headersize) {
emsgsize:
- ipv6_local_error(sk, EMSGSIZE, fl6,
- mtu - headersize +
- sizeof(struct ipv6hdr));
+ pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0);
+ ipv6_local_error(sk, EMSGSIZE, fl6, pmtu);
return -EMSGSIZE;
}
--
2.14.3
^ permalink raw reply related
* Re: [patch net-next RFC 00/12] devlink: introduce port flavours and common phys_port_name generation
From: Andrew Lunn @ 2018-03-23 13:43 UTC (permalink / raw)
To: Jiri Pirko
Cc: netdev, davem, idosch, jakub.kicinski, mlxsw, vivien.didelot,
f.fainelli, michael.chan, ganeshgr, saeedm, simon.horman,
pieter.jansenvanvuuren, john.hurley, dirk.vandermerwe,
alexander.h.duyck, ogerlitz, dsahern, vijaya.guvva,
satananda.burla, raghu.vatsavayi, felix.manlunas, gospo,
sathya.perla, vasundhara-v.volam, tariqt, eranbe,
jeffrey.t.kirsher
In-Reply-To: <20180322105522.8186-1-jiri@resnulli.us>
> I tested this for mlxsw and nfp. I have no way to test this on DSA hw,
> I would really appretiate DSA guys to test this.
Hi Jiri
With the missing break added, i get:
root@zii-devel-b:~# ./iproute2/devlink/devlink port
mdio_bus/0.1:00/0: type eth netdev lan0 flavour physical number 0
mdio_bus/0.1:00/1: type eth netdev lan1 flavour physical number 1
mdio_bus/0.1:00/2: type eth netdev lan2 flavour physical number 2
mdio_bus/0.1:00/3: type notset
mdio_bus/0.1:00/4: type notset
mdio_bus/0.1:00/5: type notset flavour dsa number 5
mdio_bus/0.1:00/6: type notset flavour cpu number 6
mdio_bus/0.2:00/0: type eth netdev lan3 flavour physical number 0
mdio_bus/0.2:00/1: type eth netdev lan4 flavour physical number 1
mdio_bus/0.2:00/2: type eth netdev lan5 flavour physical number 2
mdio_bus/0.2:00/3: type notset
mdio_bus/0.2:00/4: type notset
mdio_bus/0.2:00/5: type notset flavour dsa number 5
mdio_bus/0.2:00/6: type notset flavour dsa number 6
mdio_bus/0.4:00/0: type eth netdev lan6 flavour physical number 0
mdio_bus/0.4:00/1: type eth netdev lan7 flavour physical number 1
mdio_bus/0.4:00/2: type eth netdev lan8 flavour physical number 2
mdio_bus/0.4:00/3: type eth netdev optical3 flavour physical number 3
mdio_bus/0.4:00/4: type eth netdev optical4 flavour physical number 4
mdio_bus/0.4:00/5: type notset
mdio_bus/0.4:00/6: type notset
mdio_bus/0.4:00/7: type notset
mdio_bus/0.4:00/8: type notset
mdio_bus/0.4:00/9: type notset flavour dsa number 9
This is on a board with a DSA cluster of three switches. Some of the
switch ports are not connected to anything, so are plain 'notset'.
What is the "number X" meant to mean?
Andrew
^ permalink raw reply
* Re: [QUESTION] Mainline support for B43_PHY_AC wifi cards
From: Rafał Miłecki @ 2018-03-23 13:43 UTC (permalink / raw)
To: Juri Lelli
Cc: b43-dev, Network Development, linux-wireless@vger.kernel.org,
Linux Kernel Mailing List
In-Reply-To: <20180323094740.GA5942@localhost.localdomain>
Hi,
On 23 March 2018 at 10:47, Juri Lelli <juri.lelli@gmail.com> wrote:
> I've got a Dell XPS 13 9343/0TM99H (BIOS A15 01/23/2018) mounting a
> BCM4352 802.11ac (rev 03) wireless card and so far I've been using it on
> Fedora with broadcom-wl package (which I believe installs Broadcom's STA
> driver?). It works good apart from occasional hiccups after suspend.
>
> I'd like to get rid of that dependency (you can understand that it's
> particularly annoying when testing mainline kernels), but I found out
> that support for my card is BROKEN in mainline [1]. Just to see what
> happens, I forcibly enabled it witnessing that it indeed crashes like
> below as Kconfig warns. :)
>
> bcma: bus0: Found chip with id 0x4352, rev 0x03 and package 0x00
> bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x2B, class 0x0)
> bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x2A, class 0x0)
> bcma: bus0: Core 2 found: ARM CR4 (manuf 0x4BF, id 0x83E, rev 0x02, class 0x0)
> bcma: bus0: Core 3 found: PCIe Gen2 (manuf 0x4BF, id 0x83C, rev 0x01, class 0x0)
> bcma: bus0: Core 4 found: USB 2.0 Device (manuf 0x4BF, id 0x81A, rev 0x11, class 0x0)
> bcma: Unsupported SPROM revision: 11
> bcma: bus0: Invalid SPROM read from the PCIe card, trying to use fallback SPROM
> bcma: bus0: Using fallback SPROM failed (err -2)
> bcma: bus0: No SPROM available
> bcma: bus0: Bus registered
> b43-phy0: Broadcom 4352 WLAN found (core revision 42)
> b43-phy0: Found PHY: Analog 12, Type 11 (AC), Revision 1
> b43-phy0: Found Radio: Manuf 0x17F, ID 0x2069, Revision 4, Version 0
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
This isn't really useful without a full backtrace.
> So, question: is replacing my card the only way I can get rid of this
> downstream dependency? :(
It's definitely the cheapest way. Getting AC PHY into anything usable
(proper setup that will allow Tx & Rx anything) would probably take
weeks or months of development. I'm not even going to estimate cost of
adding support for 802.11n and 802.11ac features. I was the last
person actively working on b43, right now I spend my free time on
other hobby projects. Few people were planning to help but it seems it
never worked out for them.
^ permalink raw reply
* Re: [bpf-next V5 PATCH 11/15] page_pool: refurbish version of page_pool code
From: Eric Dumazet @ 2018-03-23 13:37 UTC (permalink / raw)
To: Jesper Dangaard Brouer, netdev, BjörnTöpel,
magnus.karlsson
Cc: eugenia, Jason Wang, John Fastabend, Eran Ben Elisha,
Saeed Mahameed, galp, Daniel Borkmann, Alexei Starovoitov,
Tariq Toukan
In-Reply-To: <152180753479.20167.856688163861554435.stgit@firesoul>
On 03/23/2018 05:18 AM, Jesper Dangaard Brouer wrote:
> +#define PP_ALLOC_CACHE_SIZE 128
> +#define PP_ALLOC_CACHE_REFILL 64
> +struct pp_alloc_cache {
> + u32 count ____cacheline_aligned_in_smp;
> + void *cache[PP_ALLOC_CACHE_SIZE];
> +};
> +
> +struct page_pool_params {
...
> +};
> +#define PAGE_POOL_PARAMS_SIZE offsetof(struct page_pool_params, end_marker)
> +
> +struct page_pool {
> + struct page_pool_params p;
> +
> + struct pp_alloc_cache alloc;
> +
>...
> + struct ptr_ring ring;
> +
> + struct rcu_head rcu;
> +};
> +
The placement of ____cacheline_aligned_in_smp in pp_alloc_cache is odd.
I would rather put it in struct page_pool as in :
+struct page_pool {
+ struct page_pool_params p;
+ struct pp_alloc_cache alloc ____cacheline_aligned_in_smp;;
To make clear the intent here (let the page_pool_params being in a read only cache line)
Also you probably can move the struct rcu_head between p and pp_alloc_cache_alloc to fill a hole.
(assuming allowing variable sized params is no longer needed)
^ permalink raw reply
* Re: [PATCH 0/2] bpf: Change print_bpf_insn interface
From: Quentin Monnet @ 2018-03-23 13:34 UTC (permalink / raw)
To: Jiri Olsa, Alexei Starovoitov, Daniel Borkmann; +Cc: lkml, netdev
In-Reply-To: <20180323104129.14989-1-jolsa@kernel.org>
2018-03-23 11:41 UTC+0100 ~ Jiri Olsa <jolsa@kernel.org>
> hi,
> this patchset removes struct bpf_verifier_env argument
> from print_bpf_insn function (patch 1) and changes user
> space bpftool user to use it that way (patch 2).
>
> thanks,
> jirka
>
> ---
> Jiri Olsa (2):
> bpf: Remove struct bpf_verifier_env argument from print_bpf_insn
> bpftool: Adjust to new print_bpf_insn interface
>
> kernel/bpf/disasm.c | 52 ++++++++++++++++++++++++++--------------------------
> kernel/bpf/disasm.h | 5 +----
> kernel/bpf/verifier.c | 44 +++++++++++++++++++++++++++-----------------
> tools/bpf/bpftool/xlated_dumper.c | 12 ++++++------
> 4 files changed, 60 insertions(+), 53 deletions(-)
>
Thanks, this version looks good to me. Please keep the "Reviewed-by"
tags when resubmitting new versions of your patch sets :)
For the series:
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
^ permalink raw reply
* Re: [PATCH iproute2] ss: Fix rendering of continuous output (-E, --events)
From: Roman Mashak @ 2018-03-23 13:30 UTC (permalink / raw)
To: Stefano Brivio; +Cc: Stephen Hemminger, netdev
In-Reply-To: <9cdf9f3efbc64f517906a45f67ab6e573f9e9292.1521793677.git.sbrivio@redhat.com>
Stefano Brivio <sbrivio@redhat.com> writes:
> Roman Mashak reported that ss currently shows no output when it
> should continuously report information about terminated sockets
> (-E, --events switch).
>
> This happens because I missed this case in 691bd854bf4a ("ss:
> Buffer raw fields first, then render them as a table") and the
> rendering function is simply not called.
>
> To fix this, we need to:
>
> - call render() every time we need to display new socket events
> from generic_show_sock(), which is only used to follow events.
> Always call it even if specific socket display functions
> return errors to ensure we clean up buffers
>
> - get the screen width every time we have new events to display,
> thus factor out getting the screen width from main() into a
> function we'll call whenever we calculate columns width
>
> - reset the current field pointer after rendering, more output
> might come after render() is called
>
> Reported-by: Roman Mashak <mrv@mojatatu.com>
> Fixes: 691bd854bf4a ("ss: Buffer raw fields first, then render them as a table")
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Thanks Stefano.
Tested-by: Roman Mashak <mrv@mojatatu.com>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox