Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

1) In TCP, don't register an FRTO for cumulatively ACK'd data that was
previously SACK'd, from Neal Cardwell.

2) Need to hold RNL mutex in ipv4 multicast code namespace cleanup,
from Cong WANG.

3) Similarly we have to hold RNL mutex for fib_rules_unregister(), also
from Cong WANG.

4) Revert and rework netns nsid allocation fix, from Nicolas Dichtel.

5) When we encapsulate for a tunnel device, skb->sk still points to the
user socket. So this leads to cases where we retraverse the
ipv4/ipv6 output path with skb->sk being of some other address
family (f.e. AF_PACKET). This can cause things to crash since the
ipv4 output path is dereferencing an AF_PACKET socket as if it were
an ipv4 one.

The short term fix for 'net' and -stable is to elide these socket
checks once we've entered an encapsulation sequence by testing
xmit_recursion.

Longer term we have a better solution wherein we pass the tunnel's
socket down through the output paths, but that is way too invasive
for 'net' and -stable.

From Hannes Frederic Sowa.

6) l2tp_init() failure path forgets to unregister per-net ops, from
Cong WANG.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
net/mlx4_core: Fix error message deprecation for ConnectX-2 cards
net: dsa: fix filling routing table from OF description
l2tp: unregister l2tp_net_ops on failure path
mvneta: dont call mvneta_adjust_link() manually
ipv6: protect skb->sk accesses from recursive dereference inside the stack
netns: don't allocate an id for dead netns
Revert "netns: don't clear nsid too early on removal"
ip6mr: call del_timer_sync() in ip6mr_free_table()
net: move fib_rules_unregister() under rtnl lock
ipv4: take rtnl_lock and mark mrt table as freed on namespace cleanup
tcp: fix FRTO undo on cumulative ACK of SACKed range
xen-netfront: transmit fully GSO-sized packets

+78 -71
+3 -1
Documentation/devicetree/bindings/net/dsa/dsa.txt
··· 19 19 (DSA_MAX_SWITCHES). 20 20 Each of these switch child nodes should have the following required properties: 21 21 22 - - reg : Describes the switch address on the MII bus 22 + - reg : Contains two fields. The first one describes the 23 + address on the MII bus. The second is the switch 24 + number that must be unique in cascaded configurations 23 25 - #address-cells : Must be 1 24 26 - #size-cells : Must be 0 25 27
+1 -6
drivers/net/ethernet/marvell/mvneta.c
··· 2658 2658 static int mvneta_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 2659 2659 { 2660 2660 struct mvneta_port *pp = netdev_priv(dev); 2661 - int ret; 2662 2661 2663 2662 if (!pp->phy_dev) 2664 2663 return -ENOTSUPP; 2665 2664 2666 - ret = phy_mii_ioctl(pp->phy_dev, ifr, cmd); 2667 - if (!ret) 2668 - mvneta_adjust_link(dev); 2669 - 2670 - return ret; 2665 + return phy_mii_ioctl(pp->phy_dev, ifr, cmd); 2671 2666 } 2672 2667 2673 2668 /* Ethtool methods */
+2 -1
drivers/net/ethernet/mellanox/mlx4/cmd.c
··· 724 724 * on the host, we deprecate the error message for this 725 725 * specific command/input_mod/opcode_mod/fw-status to be debug. 726 726 */ 727 - if (op == MLX4_CMD_SET_PORT && in_modifier == 1 && 727 + if (op == MLX4_CMD_SET_PORT && 728 + (in_modifier == 1 || in_modifier == 2) && 728 729 op_modifier == 0 && context->fw_status == CMD_STAT_BAD_SIZE) 729 730 mlx4_dbg(dev, "command 0x%x failed: fw status = 0x%x\n", 730 731 op, context->fw_status);
+1 -4
drivers/net/xen-netfront.c
··· 1008 1008 1009 1009 static int xennet_change_mtu(struct net_device *dev, int mtu) 1010 1010 { 1011 - int max = xennet_can_sg(dev) ? 1012 - XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN; 1011 + int max = xennet_can_sg(dev) ? XEN_NETIF_MAX_TX_SIZE : ETH_DATA_LEN; 1013 1012 1014 1013 if (mtu > max) 1015 1014 return -EINVAL; ··· 1277 1278 1278 1279 netdev->ethtool_ops = &xennet_ethtool_ops; 1279 1280 SET_NETDEV_DEV(netdev, &dev->dev); 1280 - 1281 - netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER); 1282 1281 1283 1282 np->netdev = netdev; 1284 1283
+6
include/linux/netdevice.h
··· 2185 2185 void synchronize_net(void); 2186 2186 int init_dummy_netdev(struct net_device *dev); 2187 2187 2188 + DECLARE_PER_CPU(int, xmit_recursion); 2189 + static inline int dev_recursion_level(void) 2190 + { 2191 + return this_cpu_read(xmit_recursion); 2192 + } 2193 + 2188 2194 struct net_device *dev_get_by_index(struct net *net, int ifindex); 2189 2195 struct net_device *__dev_get_by_index(struct net *net, int ifindex); 2190 2196 struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
-16
include/net/ip.h
··· 453 453 454 454 #endif 455 455 456 - static inline int sk_mc_loop(struct sock *sk) 457 - { 458 - if (!sk) 459 - return 1; 460 - switch (sk->sk_family) { 461 - case AF_INET: 462 - return inet_sk(sk)->mc_loop; 463 - #if IS_ENABLED(CONFIG_IPV6) 464 - case AF_INET6: 465 - return inet6_sk(sk)->mc_loop; 466 - #endif 467 - } 468 - WARN_ON(1); 469 - return 1; 470 - } 471 - 472 456 bool ip_call_ra_chain(struct sk_buff *skb); 473 457 474 458 /*
+2 -1
include/net/ip6_route.h
··· 174 174 175 175 static inline int ip6_skb_dst_mtu(struct sk_buff *skb) 176 176 { 177 - struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL; 177 + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? 178 + inet6_sk(skb->sk) : NULL; 178 179 179 180 return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ? 180 181 skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+2
include/net/sock.h
··· 1762 1762 1763 1763 struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie); 1764 1764 1765 + bool sk_mc_loop(struct sock *sk); 1766 + 1765 1767 static inline bool sk_can_gso(const struct sock *sk) 1766 1768 { 1767 1769 return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type);
+3 -1
net/core/dev.c
··· 2848 2848 #define skb_update_prio(skb) 2849 2849 #endif 2850 2850 2851 - static DEFINE_PER_CPU(int, xmit_recursion); 2851 + DEFINE_PER_CPU(int, xmit_recursion); 2852 + EXPORT_SYMBOL(xmit_recursion); 2853 + 2852 2854 #define RECURSION_LIMIT 10 2853 2855 2854 2856 /**
+1 -1
net/core/fib_rules.c
··· 175 175 176 176 spin_lock(&net->rules_mod_lock); 177 177 list_del_rcu(&ops->list); 178 - fib_rules_cleanup_ops(ops); 179 178 spin_unlock(&net->rules_mod_lock); 180 179 180 + fib_rules_cleanup_ops(ops); 181 181 call_rcu(&ops->rcu, fib_rules_put_rcu); 182 182 } 183 183 EXPORT_SYMBOL_GPL(fib_rules_unregister);
+12 -16
net/core/net_namespace.c
··· 198 198 */ 199 199 int peernet2id(struct net *net, struct net *peer) 200 200 { 201 - int id = __peernet2id(net, peer, true); 201 + bool alloc = atomic_read(&peer->count) == 0 ? false : true; 202 + int id; 202 203 204 + id = __peernet2id(net, peer, alloc); 203 205 return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED; 204 206 } 205 207 EXPORT_SYMBOL(peernet2id); ··· 351 349 static void cleanup_net(struct work_struct *work) 352 350 { 353 351 const struct pernet_operations *ops; 354 - struct net *net, *tmp, *peer; 352 + struct net *net, *tmp; 355 353 struct list_head net_kill_list; 356 354 LIST_HEAD(net_exit_list); 357 355 ··· 367 365 list_for_each_entry(net, &net_kill_list, cleanup_list) { 368 366 list_del_rcu(&net->list); 369 367 list_add_tail(&net->exit_list, &net_exit_list); 368 + for_each_net(tmp) { 369 + int id = __peernet2id(tmp, net, false); 370 + 371 + if (id >= 0) 372 + idr_remove(&tmp->netns_ids, id); 373 + } 374 + idr_destroy(&net->netns_ids); 375 + 370 376 } 371 377 rtnl_unlock(); 372 378 ··· 400 390 */ 401 391 rcu_barrier(); 402 392 403 - rtnl_lock(); 404 393 /* Finally it is safe to free my network namespace structure */ 405 394 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { 406 - /* Unreference net from all peers (no need to loop over 407 - * net_exit_list because idr_destroy() will be called for each 408 - * element of this list. 409 - */ 410 - for_each_net(peer) { 411 - int id = __peernet2id(peer, net, false); 412 - 413 - if (id >= 0) 414 - idr_remove(&peer->netns_ids, id); 415 - } 416 - idr_destroy(&net->netns_ids); 417 - 418 395 list_del_init(&net->exit_list); 419 396 put_user_ns(net->user_ns); 420 397 net_drop_ns(net); 421 398 } 422 - rtnl_unlock(); 423 399 } 424 400 static DECLARE_WORK(net_cleanup_work, cleanup_net); 425 401
+19
net/core/sock.c
··· 653 653 sock_reset_flag(sk, bit); 654 654 } 655 655 656 + bool sk_mc_loop(struct sock *sk) 657 + { 658 + if (dev_recursion_level()) 659 + return false; 660 + if (!sk) 661 + return true; 662 + switch (sk->sk_family) { 663 + case AF_INET: 664 + return inet_sk(sk)->mc_loop; 665 + #if IS_ENABLED(CONFIG_IPV6) 666 + case AF_INET6: 667 + return inet6_sk(sk)->mc_loop; 668 + #endif 669 + } 670 + WARN_ON(1); 671 + return true; 672 + } 673 + EXPORT_SYMBOL(sk_mc_loop); 674 + 656 675 /* 657 676 * This is meant for all protocols to use and covers goings on 658 677 * at the socket level. Everything here is generic.
+2
net/decnet/dn_rules.c
··· 248 248 249 249 void __exit dn_fib_rules_cleanup(void) 250 250 { 251 + rtnl_lock(); 251 252 fib_rules_unregister(dn_fib_rules_ops); 253 + rtnl_unlock(); 252 254 rcu_barrier(); 253 255 } 254 256
+7 -16
net/dsa/dsa.c
··· 501 501 #ifdef CONFIG_OF 502 502 static int dsa_of_setup_routing_table(struct dsa_platform_data *pd, 503 503 struct dsa_chip_data *cd, 504 - int chip_index, 504 + int chip_index, int port_index, 505 505 struct device_node *link) 506 506 { 507 - int ret; 508 507 const __be32 *reg; 509 - int link_port_addr; 510 508 int link_sw_addr; 511 509 struct device_node *parent_sw; 512 510 int len; ··· 517 519 if (!reg || (len != sizeof(*reg) * 2)) 518 520 return -EINVAL; 519 521 522 + /* 523 + * Get the destination switch number from the second field of its 'reg' 524 + * property, i.e. for "reg = <0x19 1>" sw_addr is '1'. 525 + */ 520 526 link_sw_addr = be32_to_cpup(reg + 1); 521 527 522 528 if (link_sw_addr >= pd->nr_chips) ··· 537 535 memset(cd->rtable, -1, pd->nr_chips * sizeof(s8)); 538 536 } 539 537 540 - reg = of_get_property(link, "reg", NULL); 541 - if (!reg) { 542 - ret = -EINVAL; 543 - goto out; 544 - } 545 - 546 - link_port_addr = be32_to_cpup(reg); 547 - 548 - cd->rtable[link_sw_addr] = link_port_addr; 538 + cd->rtable[link_sw_addr] = port_index; 549 539 550 540 return 0; 551 - out: 552 - kfree(cd->rtable); 553 - return ret; 554 541 } 555 542 556 543 static void dsa_of_free_platform_data(struct dsa_platform_data *pd) ··· 649 658 if (!strcmp(port_name, "dsa") && link && 650 659 pd->nr_chips > 1) { 651 660 ret = dsa_of_setup_routing_table(pd, cd, 652 - chip_index, link); 661 + chip_index, port_index, link); 653 662 if (ret) 654 663 goto out_free_chip; 655 664 }
+1 -2
net/ipv4/fib_frontend.c
··· 1111 1111 { 1112 1112 unsigned int i; 1113 1113 1114 + rtnl_lock(); 1114 1115 #ifdef CONFIG_IP_MULTIPLE_TABLES 1115 1116 fib4_rules_exit(net); 1116 1117 #endif 1117 - 1118 - rtnl_lock(); 1119 1118 for (i = 0; i < FIB_TABLE_HASHSZ; i++) { 1120 1119 struct fib_table *tb; 1121 1120 struct hlist_head *head;
+5
net/ipv4/ipmr.c
··· 278 278 { 279 279 struct mr_table *mrt, *next; 280 280 281 + rtnl_lock(); 281 282 list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) { 282 283 list_del(&mrt->list); 283 284 ipmr_free_table(mrt); 284 285 } 285 286 fib_rules_unregister(net->ipv4.mr_rules_ops); 287 + rtnl_unlock(); 286 288 } 287 289 #else 288 290 #define ipmr_for_each_table(mrt, net) \ ··· 310 308 311 309 static void __net_exit ipmr_rules_exit(struct net *net) 312 310 { 311 + rtnl_lock(); 313 312 ipmr_free_table(net->ipv4.mrt); 313 + net->ipv4.mrt = NULL; 314 + rtnl_unlock(); 314 315 } 315 316 #endif 316 317
+4 -3
net/ipv4/tcp_input.c
··· 3105 3105 if (!first_ackt.v64) 3106 3106 first_ackt = last_ackt; 3107 3107 3108 - if (!(sacked & TCPCB_SACKED_ACKED)) 3108 + if (!(sacked & TCPCB_SACKED_ACKED)) { 3109 3109 reord = min(pkts_acked, reord); 3110 - if (!after(scb->end_seq, tp->high_seq)) 3111 - flag |= FLAG_ORIG_SACK_ACKED; 3110 + if (!after(scb->end_seq, tp->high_seq)) 3111 + flag |= FLAG_ORIG_SACK_ACKED; 3112 + } 3112 3113 } 3113 3114 3114 3115 if (sacked & TCPCB_SACKED_ACKED)
+2
net/ipv6/fib6_rules.c
··· 322 322 323 323 static void __net_exit fib6_rules_net_exit(struct net *net) 324 324 { 325 + rtnl_lock(); 325 326 fib_rules_unregister(net->ipv6.fib6_rules_ops); 327 + rtnl_unlock(); 326 328 } 327 329 328 330 static struct pernet_operations fib6_rules_net_ops = {
+2 -1
net/ipv6/ip6_output.c
··· 542 542 { 543 543 struct sk_buff *frag; 544 544 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb); 545 - struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL; 545 + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? 546 + inet6_sk(skb->sk) : NULL; 546 547 struct ipv6hdr *tmp_hdr; 547 548 struct frag_hdr *fh; 548 549 unsigned int mtu, hlen, left, len;
+2 -2
net/ipv6/ip6mr.c
··· 267 267 list_del(&mrt->list); 268 268 ip6mr_free_table(mrt); 269 269 } 270 - rtnl_unlock(); 271 270 fib_rules_unregister(net->ipv6.mr6_rules_ops); 271 + rtnl_unlock(); 272 272 } 273 273 #else 274 274 #define ip6mr_for_each_table(mrt, net) \ ··· 336 336 337 337 static void ip6mr_free_table(struct mr6_table *mrt) 338 338 { 339 - del_timer(&mrt->ipmr_expire_timer); 339 + del_timer_sync(&mrt->ipmr_expire_timer); 340 340 mroute_clean_tables(mrt); 341 341 kfree(mrt); 342 342 }
+1
net/l2tp/l2tp_core.c
··· 1871 1871 l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0); 1872 1872 if (!l2tp_wq) { 1873 1873 pr_err("alloc_workqueue failed\n"); 1874 + unregister_pernet_device(&l2tp_net_ops); 1874 1875 rc = -ENOMEM; 1875 1876 goto out; 1876 1877 }