1. 08 Oct, 2015 6 commits
  2. 07 Oct, 2015 15 commits
  3. 06 Oct, 2015 1 commit
  4. 05 Oct, 2015 18 commits
    • Pravin B Shelar's avatar
      openvswitch: Fix ovs_vport_get_stats() · 83ffe99f
      Pravin B Shelar authored
      Not every device has dev->tstats set. So when OVS tries to calculate
      vport stats it causes kernel panic. Following patch fixes it by
      using standard API to get net-device stats.
      
      ---8<---
      Unable to handle kernel paging request at virtual address 766b4008
      Internal error: Oops: 96000005 [#1] PREEMPT SMP
      Modules linked in: vport_vxlan vxlan ip6_udp_tunnel udp_tunnel tun bridge stp llc openvswitch ipv6
      CPU: 7 PID: 1108 Comm: ovs-vswitchd Not tainted 4.3.0-rc3+ #82
      PC is at ovs_vport_get_stats+0x150/0x1f8 [openvswitch]
      <snip>
      Call trace:
       [<ffffffbffc0859f8>] ovs_vport_get_stats+0x150/0x1f8 [openvswitch]
       [<ffffffbffc07cdb0>] ovs_vport_cmd_fill_info+0x140/0x1e0 [openvswitch]
       [<ffffffbffc07cf0c>] ovs_vport_cmd_dump+0xbc/0x138 [openvswitch]
       [<ffffffc00045a5ac>] netlink_dump+0xb8/0x258
       [<ffffffc00045ace0>] __netlink_dump_start+0x120/0x178
       [<ffffffc00045dd9c>] genl_family_rcv_msg+0x2d4/0x308
       [<ffffffc00045de58>] genl_rcv_msg+0x88/0xc4
       [<ffffffc00045cf24>] netlink_rcv_skb+0xd4/0x100
       [<ffffffc00045dab0>] genl_rcv+0x30/0x48
       [<ffffffc00045c830>] netlink_unicast+0x154/0x200
       [<ffffffc00045cc9c>] netlink_sendmsg+0x308/0x364
       [<ffffffc00041e10c>] sock_sendmsg+0x14/0x2c
       [<ffffffc000420d58>] SyS_sendto+0xbc/0xf0
      Code: aa1603e1 f94037a4 aa1303e2 aa1703e0 (f9400465)
      Reported-by: default avatarTomasz Sawicki <tomasz.sawicki@objectiveintegration.uk>
      Fixes: 8c876639 ("openvswitch: Remove vport stats.")
      Signed-off-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      83ffe99f
    • Nicolas Schichan's avatar
      ARM: net: make BPF_LD | BPF_IND instruction trigger r_X initialisation to 0. · 8690f47d
      Nicolas Schichan authored
      Without this patch, if the only instructions using r_X are of the
      BPF_LD | BPF_IND type, r_X would not be reset to 0, using whatever
      value was there when entering the jited code. With this patch, r_X
      will be correctly marked as used so it will be reset to 0 in the
      prologue code.
      
      This fix also makes the test "LD_IND byte default X" pass in the
      test_bpf module when the ARM JIT is enabled.
      Signed-off-by: default avatarNicolas Schichan <nschichan@freebox.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8690f47d
    • Konstantin Khlebnikov's avatar
      ovs: do not allocate memory from offline numa node · 598c12d0
      Konstantin Khlebnikov authored
      When openvswitch tries allocate memory from offline numa node 0:
      stats = kmem_cache_alloc_node(flow_stats_cache, GFP_KERNEL | __GFP_ZERO, 0)
      It catches VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES || !node_online(nid))
      [ replaced with VM_WARN_ON(!node_online(nid)) recently ] in linux/gfp.h
      This patch disables numa affinity in this case.
      Signed-off-by: default avatarKonstantin Khlebnikov <khlebnikov@yandex-team.ru>
      Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      598c12d0
    • Daniel Borkmann's avatar
      bpf: fix panic in SO_GET_FILTER with native ebpf programs · 93d08b69
      Daniel Borkmann authored
      When sockets have a native eBPF program attached through
      setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to
      dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...),
      the following panic appears:
      
        [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null)
        [49904.178762] IP: [<ffffffff81610fd9>] sk_get_filter+0x39/0x90
        [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0
        [49904.185196] Oops: 0000 [#1] SMP
        [...]
        [49904.224677] Call Trace:
        [49904.226090]  [<ffffffff815e3d49>] sock_getsockopt+0x319/0x740
        [49904.227535]  [<ffffffff812f59e3>] ? sock_has_perm+0x63/0x70
        [49904.228953]  [<ffffffff815e2fc8>] ? release_sock+0x108/0x150
        [49904.230380]  [<ffffffff812f5a43>] ? selinux_socket_getsockopt+0x23/0x30
        [49904.231788]  [<ffffffff815dff36>] SyS_getsockopt+0xa6/0xc0
        [49904.233267]  [<ffffffff8171b9ae>] entry_SYSCALL_64_fastpath+0x12/0x71
      
      The underlying issue is the very same as in commit b382c086
      ("sock, diag: fix panic in sock_diag_put_filterinfo"), that is,
      native eBPF programs don't store an original program since this
      is only needed in cBPF ones.
      
      However, sk_get_filter() wasn't updated to test for this at the
      time when eBPF could be attached. Just throw an error to the user
      to indicate that eBPF cannot be dumped over this interface.
      That way, it can also be known that a program _is_ attached (as
      opposed to just return 0), and a different (future) method needs
      to be consulted for a dump.
      
      Fixes: 89aa0758 ("net: sock: allow eBPF programs to be attached to sockets")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      93d08b69
    • Joe Stringer's avatar
      openvswitch: Rename LABEL->LABELS · 33db4125
      Joe Stringer authored
      Conntrack LABELS (plural) are exposed by conntrack; rename the OVS name
      for these to be consistent with conntrack.
      
      Fixes: c2ac6673 "openvswitch: Allow matching on conntrack label"
      Signed-off-by: default avatarJoe Stringer <joestringer@nicira.com>
      Acked-by: default avatarPravin B Shelar <pshelar@nicira.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      33db4125
    • Andrey Vagin's avatar
      net/unix: fix logic about sk_peek_offset · e9193d60
      Andrey Vagin authored
      Now send with MSG_PEEK can return data from multiple SKBs.
      
      Unfortunately we take into account the peek offset for each skb,
      that is wrong. We need to apply the peek offset only once.
      
      In addition, the peek offset should be used only if MSG_PEEK is set.
      
      Cc: "David S. Miller" <davem@davemloft.net> (maintainer:NETWORKING
      Cc: Eric Dumazet <edumazet@google.com> (commit_signer:1/14=7%)
      Cc: Aaron Conole <aconole@bytheb.org>
      Fixes: 9f389e35 ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag")
      Signed-off-by: default avatarAndrey Vagin <avagin@openvz.org>
      Tested-by: default avatarAaron Conole <aconole@bytheb.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e9193d60
    • WANG Cong's avatar
      act_mirred: always release tcf hash · 215c90af
      WANG Cong authored
      Align with other tc actions.
      
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      215c90af
    • WANG Cong's avatar
      act_mirred: fix a race condition on mirred_list · 6bd00b85
      WANG Cong authored
      After commit 1ce87720 ("net: sched: make cls_u32 lockless")
      we began to release tc actions in a RCU callback. However,
      mirred action relies on RTNL lock to protect the global
      mirred_list, therefore we could have a race condition
      between RCU callback and netdevice event, which caused
      a list corruption as reported by Vinson.
      
      Instead of relying on RTNL lock, introduce a spinlock to
      protect this list.
      
      Note, in non-bind case, it is still called with RTNL lock,
      therefore should disable BH too.
      Reported-by: default avatarVinson Lee <vlee@twopensource.com>
      Cc: John Fastabend <john.fastabend@gmail.com>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6bd00b85
    • Jesse Brandeburg's avatar
      i40e: fix offload of GRE tunnels · fec31fff
      Jesse Brandeburg authored
      The driver still was not offloading TSO on GRE tunnels because
      it forgot to set the GSO_GRE flag, causing lots of retransmits.
      
      This fixes generic GRE traffic (like a tunnel added like below)
      whereas before it would get 1Gb/s or less, now on a 10G adapter
      it gets 8.7Gb/s.
      
      ip ad ad 11.1.0.2/24 dev ens2f0
      ip l set ens2f0 up
      ip link add gre2 type gretap remote 11.1.0.1 local 11.1.0.2 dev ens2f0
      ip l set gre2 up
      ip ad ad 192.168.124.2/24 dev gre2
      ping 192.168.124.1
      netperf -H 192.168.124.1
      Signed-off-by: default avatarJesse Brandeburg <jesse.brandeburg@intel.com>
      Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fec31fff
    • David S. Miller's avatar
      Merge tag 'wireless-drivers-for-davem-2015-10-01' of... · d2dd52bf
      David S. Miller authored
      Merge tag 'wireless-drivers-for-davem-2015-10-01' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
      
      Kalle Valo says:
      
      ====================
      pull-request: wireless-drivers 2015-10-01
      
      ath9k:
      
      * declare required extra tx headroom
      
      ath10k:
      
      * fix DMA related firmware crashes on multiple devices
      
      rt2800usb:
      
      * add usb ID 1b75:3070 for Airlive WT-2000USB
      
      b43:
      
      * probe bcma core (device) rev 0x15
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d2dd52bf
    • Jiri Benc's avatar
      ipv4: fix reply_dst leakage on arp reply · 181a4224
      Jiri Benc authored
      There are cases when the created metadata reply is not used. Ensure the
      allocated memory is freed also in such cases.
      
      Fixes: 63d008a4 ("ipv4: send arp replies to the correct tunnel")
      Reported-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      181a4224
    • Eric Dumazet's avatar
      inet: fix race in reqsk_queue_unlink() · 2306c704
      Eric Dumazet authored
      reqsk_timer_handler() tests if icsk_accept_queue.listen_opt
      is NULL at its beginning.
      
      By the time it calls inet_csk_reqsk_queue_drop() and
      reqsk_queue_unlink(), listener might have been closed and
      inet_csk_listen_stop() had called reqsk_queue_yank_acceptq()
      which sets icsk_accept_queue.listen_opt to NULL
      
      We therefore need to correctly check listen_opt being NULL
      after holding syn_wait_lock for proper synchronization.
      
      Fixes: fa76ce73 ("inet: get rid of central tcp/dccp listener timer")
      Fixes: b357a364 ("inet: fix possible panic in reqsk_queue_unlink()")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Yuchung Cheng <ycheng@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2306c704
    • Raanan Avargil's avatar
      tcp/dccp: fix old style declarations · 8695a144
      Raanan Avargil authored
      I’m using the compilation flag -Werror=old-style-declaration, which
      requires that the “inline” word would come at the beginning of the code
      line.
      
      $ make drivers/net/ethernet/intel/e1000e/e1000e.ko
      ...
      include/net/inet_timewait_sock.h:116:1: error: ‘inline’ is not at
      beginning of declaration [-Werror=old-style-declaration]
      static void inline inet_twsk_schedule(struct inet_timewait_sock *tw, int
      timeo)
      
      include/net/inet_timewait_sock.h:121:1: error: ‘inline’ is not at
      beginning of declaration [-Werror=old-style-declaration]
      static void inline inet_twsk_reschedule(struct inet_timewait_sock *tw,
      int timeo)
      
      Fixes: ed2e9239 ("tcp/dccp: fix timewait races in timer handling")
      Signed-off-by: default avatarRaanan Avargil <raanan.avargil@intel.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8695a144
    • Vladimir Zapolskiy's avatar
      net: lpc_eth: fix warnings caused by enabling unprepared clock · 33a8316d
      Vladimir Zapolskiy authored
      If common clock framework is configured, the driver generates warnings,
      which are fixed by this change:
      
          WARNING: CPU: 0 PID: 1 at linux/drivers/clk/clk.c:727 clk_core_enable+0x2c/0xa4()
          Modules linked in:
          CPU: 0 PID: 1 Comm: swapper Not tainted 4.3.0-rc2+ #141
          Hardware name: LPC32XX SoC (Flattened Device Tree)
          Backtrace:
          [<>] (dump_backtrace) from [<>] (show_stack+0x18/0x1c)
          [<>] (show_stack) from [<>] (dump_stack+0x20/0x28)
          [<>] (dump_stack) from [<>] (warn_slowpath_common+0x90/0xb8)
          [<>] (warn_slowpath_common) from [<>] (warn_slowpath_null+0x24/0x2c)
          [<>] (warn_slowpath_null) from [<>] (clk_core_enable+0x2c/0xa4)
          [<>] (clk_core_enable) from [<>] (clk_enable+0x24/0x38)
          [<>] (clk_enable) from [<>] (lpc_eth_drv_probe+0xfc/0x99c)
          [<>] (lpc_eth_drv_probe) from [<>] (platform_drv_probe+0x50/0xa0)
          [<>] (platform_drv_probe) from [<>] (driver_probe_device+0x18c/0x408)
          [<>] (driver_probe_device) from [<>] (__driver_attach+0x70/0x94)
          [<>] (__driver_attach) from [<>] (bus_for_each_dev+0x74/0x98)
          [<>] (bus_for_each_dev) from [<>] (driver_attach+0x20/0x28)
          [<>] (driver_attach) from [<>] (bus_add_driver+0x11c/0x248)
          [<>] (bus_add_driver) from [<>] (driver_register+0xa4/0xe8)
          [<>] (driver_register) from [<>] (__platform_driver_register+0x50/0x64)
          [<>] (__platform_driver_register) from [<>] (lpc_eth_driver_init+0x18/0x20)
          [<>] (lpc_eth_driver_init) from [<>] (do_one_initcall+0x11c/0x1dc)
          [<>] (do_one_initcall) from [<>] (kernel_init_freeable+0x10c/0x1d4)
          [<>] (kernel_init_freeable) from [<>] (kernel_init+0x10/0xec)
          [<>] (kernel_init) from [<>] (ret_from_fork+0x14/0x24)
      Signed-off-by: default avatarVladimir Zapolskiy <vz@mleia.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      33a8316d
    • David B. Robins's avatar
      net: usb: asix: Fix crash on skb alloc failure · f6194bcf
      David B. Robins authored
      If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will return
      but not clear rx->size. rx points to driver private data. A later call
      assumes that nonzero size means ax_skb was allocated and passes a null
      ax_skb to skb_put. Changed allocation failure return to clear size first.
      
      Found testing board with AX88772B devices.
      Signed-off-by: default avatarDavid B. Robins <linux@davidrobins.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f6194bcf
    • David S. Miller's avatar
      Merge tag 'linux-can-fixes-for-4.3-20150930' of... · 74910ea4
      David S. Miller authored
      Merge tag 'linux-can-fixes-for-4.3-20150930' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
      
      Marc Kleine-Budde says:
      
      ====================
      pull-request: can 2015-09-30
      
      this is a pull request of a single patch for 4.3.
      
      The patch is by Stephane Grosjean and add support for the peak OEM PCI card to
      the peak_pci driver by adding its device ID.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      74910ea4
    • Geliang Tang's avatar
      amd-xgbe: fix potential memory leak in xgbe-debugfs · 9dc80a74
      Geliang Tang authored
      Added kfree() to avoid the memory leak when debugfs_create_dir() fails.
      Signed-off-by: default avatarGeliang Tang <geliangtang@163.com>
      Acked-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9dc80a74
    • Guillaume Nault's avatar
      ppp: don't override sk->sk_state in pppoe_flush_dev() · e6740165
      Guillaume Nault authored
      Since commit 2b018d57 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"),
      pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the
      PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to
      PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the
      following oops:
      
      [  570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0
      [  570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
      [  570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0
      [  570.144601] Oops: 0000 [#1] SMP
      [  570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio
      [  570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1
      [  570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
      [  570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000
      [  570.144601] RIP: 0010:[<ffffffffa018c701>]  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
      [  570.144601] RSP: 0018:ffff880036b63e08  EFLAGS: 00010202
      [  570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206
      [  570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20
      [  570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000
      [  570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780
      [  570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0
      [  570.144601] FS:  00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000
      [  570.144601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0
      [  570.144601] Stack:
      [  570.144601]  ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0
      [  570.144601]  ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008
      [  570.144601]  ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5
      [  570.144601] Call Trace:
      [  570.144601]  [<ffffffff812caabe>] sock_release+0x1a/0x75
      [  570.144601]  [<ffffffff812cabad>] sock_close+0xd/0x11
      [  570.144601]  [<ffffffff811347f5>] __fput+0xff/0x1a5
      [  570.144601]  [<ffffffff811348cb>] ____fput+0x9/0xb
      [  570.144601]  [<ffffffff81056682>] task_work_run+0x66/0x90
      [  570.144601]  [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7
      [  570.144601]  [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b
      [  570.144601]  [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f
      [  570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00
      [  570.144601] RIP  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
      [  570.144601]  RSP <ffff880036b63e08>
      [  570.144601] CR2: 00000000000004e0
      [  570.200518] ---[ end trace 46956baf17349563 ]---
      
      pppoe_flush_dev() has no reason to override sk->sk_state with
      PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to
      PPPOX_DEAD, which is the correct state given that sk is unbound and
      po->pppoe_dev is NULL.
      
      Fixes: 2b018d57 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
      Tested-by: default avatarOleksii Berezhniak <core@irc.lg.ua>
      Signed-off-by: default avatarGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e6740165