1. 19 Aug, 2017 6 commits
  2. 02 Aug, 2017 3 commits
  3. 31 Jul, 2017 16 commits
  4. 24 Jul, 2017 4 commits
    • Phil Sutter's avatar
      netfilter: nf_tables: Attach process info to NFT_MSG_NEWGEN notifications · 784b4e61
      Phil Sutter authored
      This is helpful for 'nft monitor' to track which process caused a given
      change to the ruleset.
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      784b4e61
    • Taehee Yoo's avatar
      netfilter: Remove duplicated rcu_read_lock. · 0b35f603
      Taehee Yoo authored
      This patch removes duplicate rcu_read_lock().
      
      1. IPVS part:
      
      According to Julian Anastasov's mention, contexts of ipvs are described
      at: http://marc.info/?l=netfilter-devel&m=149562884514072&w=2, in summary:
      
       - packet RX/TX: does not need locks because packets come from hooks.
       - sync msg RX: backup server uses RCU locks while registering new
         connections.
       - ip_vs_ctl.c: configuration get/set, RCU locks needed.
       - xt_ipvs.c: It is a netfilter match, running from hook context.
      
      As result, rcu_read_lock and rcu_read_unlock can be removed from:
      
       - ip_vs_core.c: all
       - ip_vs_ctl.c:
         - only from ip_vs_has_real_service
       - ip_vs_ftp.c: all
       - ip_vs_proto_sctp.c: all
       - ip_vs_proto_tcp.c: all
       - ip_vs_proto_udp.c: all
       - ip_vs_xmit.c: all (contains only packet processing)
      
      2. Netfilter part:
      
      There are three types of functions that are guaranteed the rcu_read_lock().
      First, as result, functions are only called by nf_hook():
      
       - nf_conntrack_broadcast_help(), pptp_expectfn(), set_expected_rtp_rtcp().
       - tcpmss_reverse_mtu(), tproxy_laddr4(), tproxy_laddr6().
       - match_lookup_rt6(), check_hlist(), hashlimit_mt_common().
       - xt_osf_match_packet().
      
      Second, functions that caller already held the rcu_read_lock().
       - destroy_conntrack(), ctnetlink_conntrack_event().
       - ctnl_timeout_find_get(), nfqnl_nf_hook_drop().
      
      Third, functions that are mixed with type1 and type2.
      
      These functions are called by nf_hook() also these are called by
      ordinary functions that already held the rcu_read_lock():
      
       - __ctnetlink_glue_build(), ctnetlink_expect_event().
       - ctnetlink_proto_size().
      
      Applied files are below:
      
      - nf_conntrack_broadcast.c, nf_conntrack_core.c, nf_conntrack_netlink.c.
      - nf_conntrack_pptp.c, nf_conntrack_sip.c, nfnetlink_cttimeout.c.
      - nfnetlink_queue.c, xt_TCPMSS.c, xt_TPROXY.c, xt_addrtype.c.
      - xt_connlimit.c, xt_hashlimit.c, xt_osf.c
      
      Detailed calltrace can be found at:
      http://marc.info/?l=netfilter-devel&m=149667610710350&w=2Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
      Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      0b35f603
    • Pablo Neira Ayuso's avatar
      netfilter: nf_tables: keep chain counters away from hot path · 9f08ea84
      Pablo Neira Ayuso authored
      These chain counters are only used by the iptables-compat tool, that
      allow users to use the x_tables extensions from the existing nf_tables
      framework. This patch makes nf_tables by ~5% for the general usecase,
      ie. native nft users, where no chain counters are used at all.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      9f08ea84
    • Florian Westphal's avatar
      netfilter: expect: add to hash table after expect init · 56a97e70
      Florian Westphal authored
      assuming we have lockless readers we should make sure they can only
      see expectations that have already been initialized.
      
      hlist_add_head_rcu acts as memory barrier, move it after timer setup.
      
      Theoretically we could crash due to a del_timer() on other cpu
      seeing garbage data.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      56a97e70
  5. 21 Jul, 2017 1 commit
  6. 20 Jul, 2017 10 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 96080f69
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) BPF verifier signed/unsigned value tracking fix, from Daniel
          Borkmann, Edward Cree, and Josef Bacik.
      
       2) Fix memory allocation length when setting up calls to
          ->ndo_set_mac_address, from Cong Wang.
      
       3) Add a new cxgb4 device ID, from Ganesh Goudar.
      
       4) Fix FIB refcount handling, we have to set it's initial value before
          the configure callback (which can bump it). From David Ahern.
      
       5) Fix double-free in qcom/emac driver, from Timur Tabi.
      
       6) A bunch of gcc-7 string format overflow warning fixes from Arnd
          Bergmann.
      
       7) Fix link level headroom tests in ip_do_fragment(), from Vasily
          Averin.
      
       8) Fix chunk walking in SCTP when iterating over error and parameter
          headers. From Alexander Potapenko.
      
       9) TCP BBR congestion control fixes from Neal Cardwell.
      
      10) Fix SKB fragment handling in bcmgenet driver, from Doug Berger.
      
      11) BPF_CGROUP_RUN_PROG_SOCK_OPS needs to check for null __sk, from Cong
          Wang.
      
      12) xmit_recursion in ppp driver needs to be per-device not per-cpu,
          from Gao Feng.
      
      13) Cannot release skb->dst in UDP if IP options processing needs it.
          From Paolo Abeni.
      
      14) Some netdev ioctl ifr_name[] NULL termination fixes. From Alexander
          Levin and myself.
      
      15) Revert some rtnetlink notification changes that are causing
          regressions, from David Ahern.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (83 commits)
        net: bonding: Fix transmit load balancing in balance-alb mode
        rds: Make sure updates to cp_send_gen can be observed
        net: ethernet: ti: cpsw: Push the request_irq function to the end of probe
        ipv4: initialize fib_trie prior to register_netdev_notifier call.
        rtnetlink: allocate more memory for dev_set_mac_address()
        net: dsa: b53: Add missing ARL entries for BCM53125
        bpf: more tests for mixed signed and unsigned bounds checks
        bpf: add test for mixed signed and unsigned bounds checks
        bpf: fix up test cases with mixed signed/unsigned bounds
        bpf: allow to specify log level and reduce it for test_verifier
        bpf: fix mixed signed/unsigned derived min/max value bounds
        ipv6: avoid overflow of offset in ip6_find_1stfragopt
        net: tehuti: don't process data if it has not been copied from userspace
        Revert "rtnetlink: Do not generate notifications for CHANGEADDR event"
        net: dsa: mv88e6xxx: Enable CMODE config support for 6390X
        dt-binding: ptp: Add SoC compatibility strings for dte ptp clock
        NET: dwmac: Make dwmac reset unconditional
        net: Zero terminate ifr_name in dev_ifname().
        wireless: wext: terminate ifr name coming from userspace
        netfilter: fix netfilter_net_init() return
        ...
      96080f69
    • Kosuke Tatsukawa's avatar
      net: bonding: Fix transmit load balancing in balance-alb mode · cbf5ecb3
      Kosuke Tatsukawa authored
      balance-alb mode used to have transmit dynamic load balancing feature
      enabled by default.  However, transmit dynamic load balancing no longer
      works in balance-alb after commit 8b426dc5 ("bonding: remove
      hardcoded value").
      
      Both balance-tlb and balance-alb use the function bond_do_alb_xmit() to
      send packets.  This function uses the parameter tlb_dynamic_lb.
      tlb_dynamic_lb used to have the default value of 1 for balance-alb, but
      now the value is set to 0 except in balance-tlb.
      
      Re-enable transmit dyanmic load balancing by initializing tlb_dynamic_lb
      for balance-alb similar to balance-tlb.
      
      Fixes: 8b426dc5 ("bonding: remove hardcoded value")
      Signed-off-by: default avatarKosuke Tatsukawa <tatsu@ab.jp.nec.com>
      Acked-by: default avatarAndy Gospodarek <andy@greyhouse.net>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cbf5ecb3
    • Håkon Bugge's avatar
      rds: Make sure updates to cp_send_gen can be observed · e623a48e
      Håkon Bugge authored
      cp->cp_send_gen is treated as a normal variable, although it may be
      used by different threads.
      
      This is fixed by using {READ,WRITE}_ONCE when it is incremented and
      READ_ONCE when it is read outside the {acquire,release}_in_xmit
      protection.
      
      Normative reference from the Linux-Kernel Memory Model:
      
          Loads from and stores to shared (but non-atomic) variables should
          be protected with the READ_ONCE(), WRITE_ONCE(), and
          ACCESS_ONCE().
      
      Clause 5.1.2.4/25 in the C standard is also relevant.
      Signed-off-by: default avatarHåkon Bugge <haakon.bugge@oracle.com>
      Reviewed-by: default avatarKnut Omang <knut.omang@oracle.com>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e623a48e
    • Ganesh Goudar's avatar
      cxgb4: display serial config and vpd versions · 760446f9
      Ganesh Goudar authored
      print the versions of vpd and serial configuration file,
      flashed to adapter, and cleanup the relevant code.
      Signed-off-by: default avatarCasey Leedom <leedom@chelsio.com>
      Signed-off-by: default avatarGanesh Goudar <ganeshgr@chelsio.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      760446f9
    • Keerthy's avatar
      net: ethernet: ti: cpsw: Push the request_irq function to the end of probe · 070f9c65
      Keerthy authored
      Push the request_irq function to the end of probe so as
      to ensure all the required fields are populated in the event
      of an ISR getting executed right after requesting the irq.
      
      Currently while loading the crash kernel a crash was seen as
      soon as devm_request_threaded_irq was called. This was due to
      n->poll being NULL which is called as part of net_rx_action
      function.
      Suggested-by: default avatarSekhar Nori <nsekhar@ti.com>
      Signed-off-by: default avatarKeerthy <j-keerthy@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      070f9c65
    • Mahesh Bandewar's avatar
      ipv4: initialize fib_trie prior to register_netdev_notifier call. · 8799a221
      Mahesh Bandewar authored
      Net stack initialization currently initializes fib-trie after the
      first call to netdevice_notifier() call. In fact fib_trie initialization
      needs to happen before first rtnl_register(). It does not cause any problem
      since there are no devices UP at this moment, but trying to bring 'lo'
      UP at initialization would make this assumption wrong and exposes the issue.
      
      Fixes following crash
      
       Call Trace:
        ? alternate_node_alloc+0x76/0xa0
        fib_table_insert+0x1b7/0x4b0
        fib_magic.isra.17+0xea/0x120
        fib_add_ifaddr+0x7b/0x190
        fib_netdev_event+0xc0/0x130
        register_netdevice_notifier+0x1c1/0x1d0
        ip_fib_init+0x72/0x85
        ip_rt_init+0x187/0x1e9
        ip_init+0xe/0x1a
        inet_init+0x171/0x26c
        ? ipv4_offload_init+0x66/0x66
        do_one_initcall+0x43/0x160
        kernel_init_freeable+0x191/0x219
        ? rest_init+0x80/0x80
        kernel_init+0xe/0x150
        ret_from_fork+0x22/0x30
       Code: f6 46 23 04 74 86 4c 89 f7 e8 ae 45 01 00 49 89 c7 4d 85 ff 0f 85 7b ff ff ff 31 db eb 08 4c 89 ff e8 16 47 01 00 48 8b 44 24 38 <45> 8b 6e 14 4d 63 76 74 48 89 04 24 0f 1f 44 00 00 48 83 c4 08
       RIP: kmem_cache_alloc+0xcf/0x1c0 RSP: ffff9b1500017c28
       CR2: 0000000000000014
      
      Fixes: 7b1a74fd ("[NETNS]: Refactor fib initialization so it can handle multiple namespaces.")
      Fixes: 7f9b8052 ("[IPV4]: fib hash|trie initialization")
      Signed-off-by: default avatarMahesh Bandewar <maheshb@google.com>
      Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8799a221
    • WANG Cong's avatar
      rtnetlink: allocate more memory for dev_set_mac_address() · 153711f9
      WANG Cong authored
      virtnet_set_mac_address() interprets mac address as struct
      sockaddr, but upper layer only allocates dev->addr_len
      which is ETH_ALEN + sizeof(sa_family_t) in this case.
      
      We lack a unified definition for mac address, so just fix
      the upper layer, this also allows drivers to interpret it
      to struct sockaddr freely.
      Reported-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      153711f9
    • Florian Fainelli's avatar
      net: dsa: b53: Add missing ARL entries for BCM53125 · be35e8c5
      Florian Fainelli authored
      The BCM53125 entry was missing an arl_entries member which would
      basically prevent the ARL search from terminating properly. This switch
      has 4 ARL entries, so add that.
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Reviewed-by: default avatarVivien Didelot <vivien.didelot@savoirfairelinux.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be35e8c5
    • David S. Miller's avatar
      Merge branch 'BPF-map-value-adjust-fix' · 5067f4cf
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      BPF map value adjust fix
      
      First patch in the series is the actual fix and the remaining
      patches are just updates to selftests.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5067f4cf
    • Daniel Borkmann's avatar
      bpf: more tests for mixed signed and unsigned bounds checks · 86412502
      Daniel Borkmann authored
      Add a couple of more test cases to BPF selftests that are related
      to mixed signed and unsigned checks.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      86412502