1. 08 Aug, 2016 27 commits
    • David S. Miller's avatar
      Merge branch 'ipconfig-improve-dhcp-timeouts' · 9f3377ef
      David S. Miller authored
      Uwe Kleine-König says:
      
      ====================
      net: ipconfig: improve DHCP timeout handling
      
      this series teaches the ipconfig code to handle a DHCP reply on eth0 even if a
      request on eth1 was already sent out.
      This is a follow fix to 2513dfb8 ("ipconfig: handle case of delayed DHCP
      server") that dropped a late reply.
      
      This makes it possible at all to work with slow DHCP servers at all in some
      configurations and improves boot speed in general.
      
      The first patch is not really necessary, it only helps decoding debug messages
      when there is more than one device.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9f3377ef
    • Uwe Kleine-König's avatar
      net: ipconfig: drop inter-device timeout · e0688534
      Uwe Kleine-König authored
      Now that ipconfig learned to handle "delayed replies" in the previous
      commit, there is no reason any more to delay sending a first request per
      device.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e0688534
    • Uwe Kleine-König's avatar
      net: ipconfig: Support using "delayed" DHCP replies · 2647cffb
      Uwe Kleine-König authored
      The dhcp code only waits 1s between sending DHCP requests on different
      devices and only accepts an answer for the device that sent out the last
      request. Only the timeout at the end of a loop is increased iteratively
      which favours only the last device. This makes it impossible to work
      with a dhcp server that takes little more than 1s connected to a device
      that is not the last one.
      
      Instead of also increasing the inter-device timeout, teach the code to
      handle delayed replies.
      
      To accomplish that, make *ic_dev track the current ic_device instead of
      the current net_device and adapt all users accordingly. The relevant
      change then is to reset d to ic_dev on a reply to assert that the
      followup request goes through the right device.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2647cffb
    • Uwe Kleine-König's avatar
      net: ipconfig: Add device name to debug messages · 22fc5388
      Uwe Kleine-König authored
      This simplifies understanding what happens when there is more than one
      device.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      22fc5388
    • David S. Miller's avatar
      Merge branch 'be2net-next' · 874e1b75
      David S. Miller authored
      Sathya Perla says:
      
      ====================
      be2net: patch set
      
      Patch 1 fixes the driver to workaournd a bug in the Lancer FW in the
      vlan-config cmd processing. The FW in some cases clears the vlan-promisc
      setting even if it cannot apply the vlan filter. The driver has no means
      of knowing if the vlan-promisc setting has been cleared or not. This
      patch now explicitly clears the vlan-promisc setting via the RX-Filter cmd
      and then tries to program the vlan-list.
      
      Patch 2 fixes the failure path in the vlan vid add code.
      The driver currently removes a new vid from the adapter->vids[] array if
      be_vid_config() returns an error, which occurs when there is an error in
      HW/FW. This is wrong. After the HW/FW error is recovered from, we need the
      complete vids[] array to re-program the vlan list.
      
      Patch 3 fixes the ndo_set_rx_mode() path to avoid unnecessary multicast
      list updates to the FW. Each time the ndo_set_rx_mode() routine is called,
      the driver programs the multicast list in the adapter without checking
      if there are any changes to the list. This leads to a flood of RX_FILTER
      cmds when a number of vlan interfaces are configured over the device,
      as the ndo_ gets called for each vlan interface. To avoid this, we now
      use __dev_mc_sync() and __dev_uc_sync() API, but only to detect if there
      is a change in the mc/uc lists. Now that we use this API, the code has to
      be-designed to issue these API calls for each invocation of the ndo_ call.
      
      Patch 4 replaces polling with sleeping in the FW completion path.
      The ndo_set_rx_mode() and ndo_add/del_vxlan_port() calls may be called with
      BHs disabled. The driver currently issues the required cmds to the FW in
      these contexts and polls on completions from the FW, while BHs remain
      disabled.  This can cause either packet loss or packet reception to be
      delayed on that CPU.  This patch defers processing of the above cmds to a
      separate workqueue. With this change, FW cmds are now issued only in process
      context. Now that the FW cmds are issued only in process context, they can
      sleep waiting for a completion instead of polling.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      874e1b75
    • Sathya Perla's avatar
      be2net: replace polling with sleeping in the FW completion path · b7172414
      Sathya Perla authored
      The ndo_set_rx_mode() and ndo_add/del_vxlan_port() calls may be called with
      BHs disabled. The driver currently issues the required cmds to the FW in
      these contexts and polls on completions from the FW, while BHs remain
      disabled.  This can cause either packet loss or packet reception to be
      delayed on that CPU.
      
      This patch defers processing of the above cmds to a separate workqueue.
      With this change, FW cmds are now issued only in process context.
      Now that the FW cmds are issued only in process context, they can sleep
      waiting for a completion instead of polling. All the spin_lock_bh(mcc_lock)
      calls are now replaced with mutex calls.
      
      Also a new rx_filter_lock is now needed to protect the RX filtering fields
      like vids[] between be_vlan_add/rem_vid() and __be_set_rx_mode() contexts.
      Signed-off-by: default avatarSathya Perla <sathya.perla@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b7172414
    • Sriharsha Basavapatna's avatar
      be2net: Avoid unnecessary firmware updates of multicast list · 92fbb1df
      Sriharsha Basavapatna authored
      Eachtime the ndo_set_rx_mode() routine is called, the driver programs the
      multicast list in the adapter without checking if there are any changes to
      the list. This leads to a flood of RX_FILTER cmds when a number of vlan
      interfaces are configured over the device, as the ndo_ gets
      called for each vlan interface. To avoid this, we now use __dev_mc_sync()
      and __dev_uc_sync() API, but only to detect if there is a change in the
      mc/uc lists. Now that we use this API, the code has to be-designed to
      issue these API calls for each invocation of the be_set_rx_mode() call.
      Signed-off-by: default avatarSriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
      Signed-off-by: default avatarSathya Perla <sathya.perla@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      92fbb1df
    • Sathya Perla's avatar
      be2net: do not remove vids from driver table if be_vid_config() fails. · 0aff1fbf
      Sathya Perla authored
      The driver currently removes a new vid from the adapter->vids[] array if
      be_vid_config() returns an error, which occurs when there is an error in
      HW/FW. This is wrong. After the HW/FW error is recovered from, we need the
      complete vids[] array to re-program the vlan list.
      Signed-off-by: default avatarSathya Perla <sathya.perla@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0aff1fbf
    • Somnath Kotur's avatar
      be2net: clear vlan-promisc setting before programming the vlan list · 841f60fc
      Somnath Kotur authored
      The Lancer FW has a bug due to which in some cases vlan-promisc setting
      is cleared eventhough the vlan-list programming did not succeed (via
      VLAN_CONFIG) cmd. The driver has no way of knowing if the vlan-promisc
      mode was cleared or not when this cmd fails. To work around this issue,
      this patch first explicitly clears the vlan-promisc mode via RX_FILTER
      cmd and then tries to program the vlan list.
      Signed-off-by: default avatarSomnath Kotur <somnath.kotur@emulex.com>
      Signed-off-by: default avatarSathya Perla <sathya.perla@broadcom.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      841f60fc
    • Julian Anastasov's avatar
      neigh: allow admin to set NUD_STALE · 0e7bbcc1
      Julian Anastasov authored
      Admin should be able to set any state. Currently, this fails
      when lladdr is not changed and state is changed from
      NUD_CONNECTED to NUD_STALE:
      
      ip neigh add 192.168.8.1 lladdr 00:11:22:33:44:55 nud perm dev wlan0
      ip neigh show to 192.168.8.1
      192.168.8.1 dev wlan0 lladdr 00:11:22:33:44:55 PERMANENT
      ip neigh change 192.168.8.1 lladdr 00:11:22:33:44:55 nud stale dev wlan0
      ip neigh show to 192.168.8.1
      192.168.8.1 dev wlan0 lladdr 00:11:22:33:44:55 PERMANENT
      
      Problem may be from 2.1.X days.
      Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
      Reviewed-by: default avatarChunhui He <hchunhui@mail.ustc.edu.cn>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0e7bbcc1
    • Xin Long's avatar
      sctp: use event->chunk when it's valid · 1fe323aa
      Xin Long authored
      Commit 52253db9 ("sctp: also point GSO head_skb to the sk when
      it's available") used event->chunk->head_skb to get the head_skb in
      sctp_ulpevent_set_owner().
      
      But at that moment, the event->chunk was NULL, as it cloned the skb
      in sctp_ulpevent_make_rcvmsg(). Therefore, that patch didn't really
      work.
      
      This patch is to move the event->chunk initialization before calling
      sctp_ulpevent_receive_data() so that it uses event->chunk when it's
      valid.
      
      Fixes: 52253db9 ("sctp: also point GSO head_skb to the sk when it's available")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1fe323aa
    • pravin shelar's avatar
      net: vxlan: lwt: Fix vxlan local traffic. · bbec7802
      pravin shelar authored
      vxlan driver has bypass for local vxlan traffic, but that
      depends on information about all VNIs on local system in
      vxlan driver. This is not available in case of LWT.
      Therefore following patch disable encap bypass for LWT
      vxlan traffic.
      
      Fixes: ee122c79 ("vxlan: Flow based tunneling").
      Reported-by: default avatarJakub Libosvar <jlibosva@redhat.com>
      Signed-off-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Acked-by: default avatarJiri Benc <jbenc@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bbec7802
    • pravin shelar's avatar
      net: vxlan: lwt: Use source ip address during route lookup. · 272d96a5
      pravin shelar authored
      LWT user can specify destination as well as source ip address
      for given tunnel endpoint. But vxlan is ignoring given source
      ip address. Following patch uses both ip address to route the
      tunnel packet. This consistent with other LWT implementations,
      like GENEVE and GRE.
      
      Fixes: ee122c79 ("vxlan: Flow based tunneling").
      Signed-off-by: default avatarPravin B Shelar <pshelar@ovn.org>
      Acked-by: default avatarJiri Benc <jbenc@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      272d96a5
    • David S. Miller's avatar
      Merge branch 'bpf-csum-complete' · da1b4195
      David S. Miller authored
      Daniel Borkmann says:
      
      ====================
      Few BPF helper related checksum fixes
      
      The set contains three fixes with regards to CHECKSUM_COMPLETE
      and BPF helper functions. For details please see individual
      patches.
      
      Thanks!
      
      v1 -> v2:
        - Fixed make htmldocs issue reported by kbuild bot.
        - Rest as is.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      da1b4195
    • Daniel Borkmann's avatar
      bpf: fix checksum for vlan push/pop helper · 8065694e
      Daniel Borkmann authored
      When having skbs on ingress with CHECKSUM_COMPLETE, tc BPF programs don't
      push rcsum of mac header back in and after BPF run back pull out again as
      opposed to some other subsystems (ovs, for example).
      
      For cases like q-in-q, meaning when a vlan tag for offloading is already
      present and we're about to push another one, then skb_vlan_push() pushes the
      inner one into the skb, increasing mac header and skb_postpush_rcsum()'ing
      the 4 bytes vlan header diff. Likewise, for the reverse operation in
      skb_vlan_pop() for the case where vlan header needs to be pulled out of the
      skb, we're decreasing the mac header and skb_postpull_rcsum()'ing the 4 bytes
      rcsum of the vlan header that was removed.
      
      However mangling the rcsum here will lead to hw csum failure for BPF case,
      since we're pulling or pushing data that was not part of the current rcsum.
      Changing tc BPF programs in general to push/pull rcsum around BPF_PROG_RUN()
      is also not really an option since current behaviour is ABI by now, but apart
      from that would also mean to do quite a bit of useless work in the sense that
      usually 12 bytes need to be rcsum pushed/pulled also when we don't need to
      touch this vlan related corner case. One way to fix it would be to push the
      necessary rcsum fixup down into vlan helpers that are (mostly) slow-path
      anyway.
      
      Fixes: 4e10df9a ("bpf: introduce bpf_skb_vlan_push/pop() helpers")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8065694e
    • Daniel Borkmann's avatar
      bpf: fix checksum fixups on bpf_skb_store_bytes · 479ffccc
      Daniel Borkmann authored
      bpf_skb_store_bytes() invocations above L2 header need BPF_F_RECOMPUTE_CSUM
      flag for updates, so that CHECKSUM_COMPLETE will be fixed up along the way.
      Where we ran into an issue with bpf_skb_store_bytes() is when we did a
      single-byte update on the IPv6 hoplimit despite using BPF_F_RECOMPUTE_CSUM
      flag; simple ping via ICMPv6 triggered a hw csum failure as a result. The
      underlying issue has been tracked down to a buffer alignment issue.
      
      Meaning, that csum_partial() computations via skb_postpull_rcsum() and
      skb_postpush_rcsum() pair invoked had a wrong result since they operated on
      an odd address for the hoplimit, while other computations were done on an
      even address. This mix doesn't work as-is with skb_postpull_rcsum(),
      skb_postpush_rcsum() pair as it always expects at least half-word alignment
      of input buffers, which is normally the case. Thus, instead of these helpers
      using csum_sub() and (implicitly) csum_add(), we need to use csum_block_sub(),
      csum_block_add(), respectively. For unaligned offsets, they rotate the sum
      to align it to a half-word boundary again, otherwise they work the same as
      csum_sub() and csum_add().
      
      Adding __skb_postpull_rcsum(), __skb_postpush_rcsum() variants that take the
      offset as an input and adapting bpf_skb_store_bytes() to them fixes the hw
      csum failures again. The skb_postpull_rcsum(), skb_postpush_rcsum() helpers
      use a 0 constant for offset so that the compiler optimizes the offset & 1
      test away and generates the same code as with csum_sub()/_add().
      
      Fixes: 608cd71a ("tc: bpf: generalize pedit action")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      479ffccc
    • Daniel Borkmann's avatar
      bpf: also call skb_postpush_rcsum on xmit occasions · a2bfe6bf
      Daniel Borkmann authored
      Follow-up to commit f8ffad69 ("bpf: add skb_postpush_rcsum and fix
      dev_forward_skb occasions") to fix an issue for dev_queue_xmit() redirect
      locations which need CHECKSUM_COMPLETE fixups on ingress.
      
      For the same reasons as described in f8ffad69 already, we of course
      also need this here, since dev_queue_xmit() on a veth device will let us
      end up in the dev_forward_skb() helper again to cross namespaces.
      
      Latter then calls into skb_postpull_rcsum() to pull out L2 header, so
      that netif_rx_internal() sees CHECKSUM_COMPLETE as it is expected. That
      is, CHECKSUM_COMPLETE on ingress covering L2 _payload_, not L2 headers.
      
      Also here we have to address bpf_redirect() and bpf_clone_redirect().
      
      Fixes: 3896d655 ("bpf: introduce bpf_clone_redirect() helper")
      Fixes: 27b29f63 ("bpf: add bpf_redirect() helper")
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a2bfe6bf
    • Paul Gortmaker's avatar
      net/ethernet: tundra: fix dump_eth_one warning in tsi108_eth · 66cf3504
      Paul Gortmaker authored
      The call site for this function appears as:
      
        #ifdef DEBUG
              data->msg_enable = DEBUG;
              dump_eth_one(dev);
        #endif
      
      ...leading to the following warning for !DEBUG builds:
      
      drivers/net/ethernet/tundra/tsi108_eth.c:169:13: warning: 'dump_eth_one' defined but not used [-Wunused-function]
       static void dump_eth_one(struct net_device *dev)
                   ^
      
      ...when using the arch/powerpc/configs/mpc7448_hpc2_defconfig
      
      Put the function definition under the same #ifdef as the call site
      to avoid the warning.
      
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: netdev@vger.kernel.org
      Cc: linuxppc-dev@lists.ozlabs.org
      Signed-off-by: default avatarPaul Gortmaker <paul.gortmaker@windriver.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      66cf3504
    • David S. Miller's avatar
      Merge branch 'mlxsw-dcb-fixes' · 61ec4bce
      David S. Miller authored
      Ido Schimmel says:
      
      ====================
      mlxsw: DCB fixes
      
      Patches 1 and 2 fix a problem in which PAUSE frames settings are wrongly
      overridden when ieee_setpfc() gets called.
      
      Patch 3 adds a missing rollback in port's creation error path.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      61ec4bce
    • Ido Schimmel's avatar
      mlxsw: spectrum: Add missing DCB rollback in error path · 4de34eb5
      Ido Schimmel authored
      We correctly execute mlxsw_sp_port_dcb_fini() when port is removed, but
      I missed its rollback in the error path of port creation, so add it.
      
      Fixes: f00817df ("mlxsw: spectrum: Introduce support for Data Center Bridging (DCB)")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4de34eb5
    • Ido Schimmel's avatar
      mlxsw: spectrum: Do not override PAUSE settings · 07d50cae
      Ido Schimmel authored
      The PFCC register is used to configure both PAUSE and PFC frames.
      Therefore, when PFC frames are disabled we must make sure we don't
      mistakenly also disable PAUSE frames (which might be enabled).
      
      Fix this by packing the PFCC register with the current PAUSE settings.
      
      Note that this register is also accessed via ethtool ops, but there we
      are guaranteed to have PFC disabled.
      
      Fixes: d81a6bdb ("mlxsw: spectrum: Add IEEE 802.1Qbb PFC support")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07d50cae
    • Ido Schimmel's avatar
      mlxsw: spectrum: Do not assume PAUSE frames are disabled · b489a200
      Ido Schimmel authored
      When ieee_setpfc() gets called, PAUSE frames are not necessarily
      disabled on the port.
      
      Check if PAUSE frames are disabled or enabled and configure the port's
      headroom buffer accordingly.
      
      Fixes: d81a6bdb ("mlxsw: spectrum: Add IEEE 802.1Qbb PFC support")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Reviewed-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b489a200
    • Phil Sutter's avatar
      rhashtable-test: Fix max_size parameter description · 3b3bf80b
      Phil Sutter authored
      Looks like a simple copy'n'paste error.
      
      Fixes: 1aa661f5 ("rhashtable-test: Measure time to insert, remove & traverse entries")
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3b3bf80b
    • David S. Miller's avatar
      Merge branch 'sctp_diag-fixes' · 05ec40f0
      David S. Miller authored
      Phil Sutter says:
      
      ====================
      sctp_diag: A bunch of fixes for upcoming 'ss' support
      
      The following series contains a number of fixes necessary to make my yet
      unpublished 'ss' support patch functional.
      
      Changes since v1:
      - Fixed patch 2/3
      - Rebased whole series onto current net-next/master
      
      Changes since v2:
      - Improved description of patch 2/3
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      05ec40f0
    • Phil Sutter's avatar
      sctp_diag: Respect ss adding TCPF_CLOSE to idiag_states · 1ba8d77f
      Phil Sutter authored
      Since 'ss' always adds TCPF_CLOSE to idiag_states flags, sctp_diag can't
      rely upon TCPF_LISTEN flag solely being present when listening sockets
      are requested.
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1ba8d77f
    • Phil Sutter's avatar
      sctp_diag: Fix T3_rtx timer export · 12474e8e
      Phil Sutter authored
      The asoc's timer value is not kept in asoc->timeouts array but in it's
      primary transport instead.
      
      Furthermore, we must export the timer only if it is pending, otherwise
      the value will underrun when stored in an unsigned variable and
      user space will only see a very large timeout value.
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      12474e8e
    • Phil Sutter's avatar
      sctp: Export struct sctp_info to userspace · dca3f53c
      Phil Sutter authored
      This is required to correctly interpret INET_DIAG_INFO messages exported
      by sctp_diag module.
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dca3f53c
  2. 07 Aug, 2016 4 commits
  3. 06 Aug, 2016 5 commits
    • Geert Uytterhoeven's avatar
      net: dsa: b53: Add missing ULL suffix for 64-bit constant · 5e3b724e
      Geert Uytterhoeven authored
      On 32-bit (e.g. with m68k-linux-gnu-gcc-4.1):
      
          drivers/net/dsa/b53/b53_common.c: In function ‘b53_arl_read’:
          drivers/net/dsa/b53/b53_common.c:1072: warning: integer constant is too large for ‘long’ type
      
      Fixes: 1da6df85 ("net: dsa: b53: Implement ARL add/del/dump operations")
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5e3b724e
    • David Forster's avatar
      ipv4: panic in leaf_walk_rcu due to stale node pointer · 94d9f1c5
      David Forster authored
      Panic occurs when issuing "cat /proc/net/route" whilst
      populating FIB with > 1M routes.
      
      Use of cached node pointer in fib_route_get_idx is unsafe.
      
       BUG: unable to handle kernel paging request at ffffc90001630024
       IP: [<ffffffff814cf6a0>] leaf_walk_rcu+0x10/0xe0
       PGD 11b08d067 PUD 11b08e067 PMD dac4b067 PTE 0
       Oops: 0000 [#1] SMP
       Modules linked in: nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscac
       snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep virti
       acpi_cpufreq button parport_pc ppdev lp parport autofs4 ext4 crc16 mbcache jbd
      tio_ring virtio floppy uhci_hcd ehci_hcd usbcore usb_common libata scsi_mod
       CPU: 1 PID: 785 Comm: cat Not tainted 4.2.0-rc8+ #4
       Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
       task: ffff8800da1c0bc0 ti: ffff88011a05c000 task.ti: ffff88011a05c000
       RIP: 0010:[<ffffffff814cf6a0>]  [<ffffffff814cf6a0>] leaf_walk_rcu+0x10/0xe0
       RSP: 0018:ffff88011a05fda0  EFLAGS: 00010202
       RAX: ffff8800d8a40c00 RBX: ffff8800da4af940 RCX: ffff88011a05ff20
       RDX: ffffc90001630020 RSI: 0000000001013531 RDI: ffff8800da4af950
       RBP: 0000000000000000 R08: ffff8800da1f9a00 R09: 0000000000000000
       R10: ffff8800db45b7e4 R11: 0000000000000246 R12: ffff8800da4af950
       R13: ffff8800d97a74c0 R14: 0000000000000000 R15: ffff8800d97a7480
       FS:  00007fd3970e0700(0000) GS:ffff88011fd00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
       CR2: ffffc90001630024 CR3: 000000011a7e4000 CR4: 00000000000006e0
       Stack:
        ffffffff814d00d3 0000000000000000 ffff88011a05ff20 ffff8800da1f9a00
        ffffffff811dd8b9 0000000000000800 0000000000020000 00007fd396f35000
        ffffffff811f8714 0000000000003431 ffffffff8138dce0 0000000000000f80
       Call Trace:
        [<ffffffff814d00d3>] ? fib_route_seq_start+0x93/0xc0
        [<ffffffff811dd8b9>] ? seq_read+0x149/0x380
        [<ffffffff811f8714>] ? fsnotify+0x3b4/0x500
        [<ffffffff8138dce0>] ? process_echoes+0x70/0x70
        [<ffffffff8121cfa7>] ? proc_reg_read+0x47/0x70
        [<ffffffff811bb823>] ? __vfs_read+0x23/0xd0
        [<ffffffff811bbd42>] ? rw_verify_area+0x52/0xf0
        [<ffffffff811bbe61>] ? vfs_read+0x81/0x120
        [<ffffffff811bcbc2>] ? SyS_read+0x42/0xa0
        [<ffffffff81549ab2>] ? entry_SYSCALL_64_fastpath+0x16/0x75
       Code: 48 85 c0 75 d8 f3 c3 31 c0 c3 f3 c3 66 66 66 66 66 66 2e 0f 1f 84 00 00
      a 04 89 f0 33 02 44 89 c9 48 d3 e8 0f b6 4a 05 49 89
       RIP  [<ffffffff814cf6a0>] leaf_walk_rcu+0x10/0xe0
        RSP <ffff88011a05fda0>
       CR2: ffffc90001630024
      Signed-off-by: default avatarDave Forster <dforster@brocade.com>
      Acked-by: default avatarAlexander Duyck <alexander.h.duyck@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      94d9f1c5
    • David Howells's avatar
      rxrpc: Fix races between skb free, ACK generation and replying · 372ee163
      David Howells authored
      Inside the kafs filesystem it is possible to occasionally have a call
      processed and terminated before we've had a chance to check whether we need
      to clean up the rx queue for that call because afs_send_simple_reply() ends
      the call when it is done, but this is done in a workqueue item that might
      happen to run to completion before afs_deliver_to_call() completes.
      
      Further, it is possible for rxrpc_kernel_send_data() to be called to send a
      reply before the last request-phase data skb is released.  The rxrpc skb
      destructor is where the ACK processing is done and the call state is
      advanced upon release of the last skb.  ACK generation is also deferred to
      a work item because it's possible that the skb destructor is not called in
      a context where kernel_sendmsg() can be invoked.
      
      To this end, the following changes are made:
      
       (1) kernel_rxrpc_data_consumed() is added.  This should be called whenever
           an skb is emptied so as to crank the ACK and call states.  This does
           not release the skb, however.  kernel_rxrpc_free_skb() must now be
           called to achieve that.  These together replace
           rxrpc_kernel_data_delivered().
      
       (2) kernel_rxrpc_data_consumed() is wrapped by afs_data_consumed().
      
           This makes afs_deliver_to_call() easier to work as the skb can simply
           be discarded unconditionally here without trying to work out what the
           return value of the ->deliver() function means.
      
           The ->deliver() functions can, via afs_data_complete(),
           afs_transfer_reply() and afs_extract_data() mark that an skb has been
           consumed (thereby cranking the state) without the need to
           conditionally free the skb to make sure the state is correct on an
           incoming call for when the call processor tries to send the reply.
      
       (3) rxrpc_recvmsg() now has to call kernel_rxrpc_data_consumed() when it
           has finished with a packet and MSG_PEEK isn't set.
      
       (4) rxrpc_packet_destructor() no longer calls rxrpc_hard_ACK_data().
      
           Because of this, we no longer need to clear the destructor and put the
           call before we free the skb in cases where we don't want the ACK/call
           state to be cranked.
      
       (5) The ->deliver() call-type callbacks are made to return -EAGAIN rather
           than 0 if they expect more data (afs_extract_data() returns -EAGAIN to
           the delivery function already), and the caller is now responsible for
           producing an abort if that was the last packet.
      
       (6) There are many bits of unmarshalling code where:
      
       		ret = afs_extract_data(call, skb, last, ...);
      		switch (ret) {
      		case 0:		break;
      		case -EAGAIN:	return 0;
      		default:	return ret;
      		}
      
           is to be found.  As -EAGAIN can now be passed back to the caller, we
           now just return if ret < 0:
      
       		ret = afs_extract_data(call, skb, last, ...);
      		if (ret < 0)
      			return ret;
      
       (7) Checks for trailing data and empty final data packets has been
           consolidated as afs_data_complete().  So:
      
      		if (skb->len > 0)
      			return -EBADMSG;
      		if (!last)
      			return 0;
      
           becomes:
      
      		ret = afs_data_complete(call, skb, last);
      		if (ret < 0)
      			return ret;
      
       (8) afs_transfer_reply() now checks the amount of data it has against the
           amount of data desired and the amount of data in the skb and returns
           an error to induce an abort if we don't get exactly what we want.
      
      Without these changes, the following oops can occasionally be observed,
      particularly if some printks are inserted into the delivery path:
      
      general protection fault: 0000 [#1] SMP
      Modules linked in: kafs(E) af_rxrpc(E) [last unloaded: af_rxrpc]
      CPU: 0 PID: 1305 Comm: kworker/u8:3 Tainted: G            E   4.7.0-fsdevel+ #1303
      Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
      Workqueue: kafsd afs_async_workfn [kafs]
      task: ffff88040be041c0 ti: ffff88040c070000 task.ti: ffff88040c070000
      RIP: 0010:[<ffffffff8108fd3c>]  [<ffffffff8108fd3c>] __lock_acquire+0xcf/0x15a1
      RSP: 0018:ffff88040c073bc0  EFLAGS: 00010002
      RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000000 RCX: ffff88040d29a710
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88040d29a710
      RBP: ffff88040c073c70 R08: 0000000000000001 R09: 0000000000000001
      R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
      R13: 0000000000000000 R14: ffff88040be041c0 R15: ffffffff814c928f
      FS:  0000000000000000(0000) GS:ffff88041fa00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007fa4595f4750 CR3: 0000000001c14000 CR4: 00000000001406f0
      Stack:
       0000000000000006 000000000be04930 0000000000000000 ffff880400000000
       ffff880400000000 ffffffff8108f847 ffff88040be041c0 ffffffff81050446
       ffff8803fc08a920 ffff8803fc08a958 ffff88040be041c0 ffff88040c073c38
      Call Trace:
       [<ffffffff8108f847>] ? mark_held_locks+0x5e/0x74
       [<ffffffff81050446>] ? __local_bh_enable_ip+0x9b/0xa1
       [<ffffffff8108f9ca>] ? trace_hardirqs_on_caller+0x16d/0x189
       [<ffffffff810915f4>] lock_acquire+0x122/0x1b6
       [<ffffffff810915f4>] ? lock_acquire+0x122/0x1b6
       [<ffffffff814c928f>] ? skb_dequeue+0x18/0x61
       [<ffffffff81609dbf>] _raw_spin_lock_irqsave+0x35/0x49
       [<ffffffff814c928f>] ? skb_dequeue+0x18/0x61
       [<ffffffff814c928f>] skb_dequeue+0x18/0x61
       [<ffffffffa009aa92>] afs_deliver_to_call+0x344/0x39d [kafs]
       [<ffffffffa009ab37>] afs_process_async_call+0x4c/0xd5 [kafs]
       [<ffffffffa0099e9c>] afs_async_workfn+0xe/0x10 [kafs]
       [<ffffffff81063a3a>] process_one_work+0x29d/0x57c
       [<ffffffff81064ac2>] worker_thread+0x24a/0x385
       [<ffffffff81064878>] ? rescuer_thread+0x2d0/0x2d0
       [<ffffffff810696f5>] kthread+0xf3/0xfb
       [<ffffffff8160a6ff>] ret_from_fork+0x1f/0x40
       [<ffffffff81069602>] ? kthread_create_on_node+0x1cf/0x1cf
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      372ee163
    • Wei Yongjun's avatar
      net: arc_emac: add missing of_node_put() in arc_emac_probe() · 54447f1a
      Wei Yongjun authored
      commit a94efbd7 ("ethernet: arc: emac_main: add missing of_node_put
      after calling of_parse_phandle") added missing of_node_put after calling
      of_parse_phandle, but missing the devm_ioremap_resource() error handling
      case.
      Signed-off-by: default avatarWei Yongjun <weiyj.lk@gmail.com>
      Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      54447f1a
    • Ian Wienand's avatar
      OVS: Ignore negative headroom value · 5ef9f289
      Ian Wienand authored
      net_device->ndo_set_rx_headroom (introduced in
      871b642a) says
      
        "Setting a negtaive value reset the rx headroom
         to the default value".
      
      It seems that the OVS implementation in
      3a927bc7 overlooked this and sets
      dev->needed_headroom unconditionally.
      
      This doesn't have an immediate effect, but can mess up later
      LL_RESERVED_SPACE calculations, such as done in
      net/ipv6/mcast.c:mld_newpack.  For reference, this issue was found
      from a skb_panic raised there after the length calculations had given
      the wrong result.
      
      Note the other current users of this interface
      (drivers/net/tun.c:tun_set_headroom and
      drivers/net/veth.c:veth_set_rx_headroom) are both checking this
      correctly thus need no modification.
      
      Thanks to Ben for some pointers from the crash dumps!
      
      Cc: Benjamin Poirier <bpoirier@suse.com>
      Cc: Paolo Abeni <pabeni@redhat.com>
      Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1361414Signed-off-by: default avatarIan Wienand <iwienand@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5ef9f289
  4. 05 Aug, 2016 4 commits