1. 26 Jan, 2018 4 commits
  2. 25 Jan, 2018 3 commits
    • Nicolas Dichtel's avatar
      net: don't call update_pmtu unconditionally · f15ca723
      Nicolas Dichtel authored
      Some dst_ops (e.g. md_dst_ops)) doesn't set this handler. It may result to:
      "BUG: unable to handle kernel NULL pointer dereference at           (null)"
      
      Let's add a helper to check if update_pmtu is available before calling it.
      
      Fixes: 52a589d5 ("geneve: update skb dst pmtu on tx path")
      Fixes: a93bf0ff ("vxlan: update skb dst pmtu on tx path")
      CC: Roman Kapl <code@rkapl.cz>
      CC: Xin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f15ca723
    • Dan Streetman's avatar
      net: tcp: close sock if net namespace is exiting · 4ee806d5
      Dan Streetman authored
      When a tcp socket is closed, if it detects that its net namespace is
      exiting, close immediately and do not wait for FIN sequence.
      
      For normal sockets, a reference is taken to their net namespace, so it will
      never exit while the socket is open.  However, kernel sockets do not take a
      reference to their net namespace, so it may begin exiting while the kernel
      socket is still open.  In this case if the kernel socket is a tcp socket,
      it will stay open trying to complete its close sequence.  The sock's dst(s)
      hold a reference to their interface, which are all transferred to the
      namespace's loopback interface when the real interfaces are taken down.
      When the namespace tries to take down its loopback interface, it hangs
      waiting for all references to the loopback interface to release, which
      results in messages like:
      
      unregister_netdevice: waiting for lo to become free. Usage count = 1
      
      These messages continue until the socket finally times out and closes.
      Since the net namespace cleanup holds the net_mutex while calling its
      registered pernet callbacks, any new net namespace initialization is
      blocked until the current net namespace finishes exiting.
      
      After this change, the tcp socket notices the exiting net namespace, and
      closes immediately, releasing its dst(s) and their reference to the
      loopback interface, which lets the net namespace continue exiting.
      
      Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1711407
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=97811Signed-off-by: default avatarDan Streetman <ddstreet@canonical.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4ee806d5
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 5b7d2796
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Avoid negative netdev refcount in error flow of xfrm state add, from
          Aviad Yehezkel.
      
       2) Fix tcpdump decoding of IPSEC decap'd frames by filling in the
          ethernet header protocol field in xfrm{4,6}_mode_tunnel_input().
          From Yossi Kuperman.
      
       3) Fix a syzbot triggered skb_under_panic in pppoe having to do with
          failing to allocate an appropriate amount of headroom. From
          Guillaume Nault.
      
       4) Fix memory leak in vmxnet3 driver, from Neil Horman.
      
       5) Cure out-of-bounds packet memory access in em_nbyte EMATCH module,
          from Wolfgang Bumiller.
      
       6) Restrict what kinds of sockets can be bound to the KCM multiplexer
          and also disallow when another layer has attached to the socket and
          made use of sk_user_data. From Tom Herbert.
      
       7) Fix use before init of IOTLB in vhost code, from Jason Wang.
      
       8) Correct STACR register write bit definition in IBM emac driver, from
          Ivan Mikhaylov.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        net/ibm/emac: wrong bit is used for STA control register write
        net/ibm/emac: add 8192 rx/tx fifo size
        vhost: do not try to access device IOTLB when not initialized
        vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()
        i40e: flower: check if TC offload is enabled on a netdev
        qed: Free reserved MR tid
        qed: Remove reserveration of dpi for kernel
        kcm: Check if sk_user_data already set in kcm_attach
        kcm: Only allow TCP sockets to be attached to a KCM mux
        net: sched: fix TCF_LAYER_LINK case in tcf_get_base_ptr
        net: sched: em_nbyte: don't add the data offset twice
        mlxsw: spectrum_router: Don't log an error on missing neighbor
        vmxnet3: repair memory leak
        ipv6: Fix getsockopt() for sockets with default IPV6_AUTOFLOWLABEL
        pppoe: take ->needed_headroom of lower device into account on xmit
        xfrm: fix boolean assignment in xfrm_get_type_offload
        xfrm: Fix eth_hdr(skb)->h_proto to reflect inner IP version
        xfrm: fix error flow in case of add state fails
        xfrm: Add SA to hardware at the end of xfrm_state_construct()
      5b7d2796
  3. 24 Jan, 2018 24 commits
  4. 23 Jan, 2018 8 commits
  5. 22 Jan, 2018 1 commit
    • Martin Brandenburg's avatar
      orangefs: initialize op on loop restart in orangefs_devreq_read · a0ec1ded
      Martin Brandenburg authored
      In orangefs_devreq_read, there is a loop which picks an op off the list
      of pending ops.  If the loop fails to find an op, there is nothing to
      read, and it returns EAGAIN.  If the op has been given up on, the loop
      is restarted via a goto.  The bug is that the variable which the found
      op is written to is not reinitialized, so if there are no more eligible
      ops on the list, the code runs again on the already handled op.
      
      This is triggered by interrupting a process while the op is being copied
      to the client-core.  It's a fairly small window, but it's there.
      Signed-off-by: default avatarMartin Brandenburg <martin@omnibond.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a0ec1ded