1. 30 8月, 2017 1 次提交
  2. 29 8月, 2017 20 次提交
    • F
      net: dsa: Don't dereference dst->cpu_dp->netdev · c7848399
      Florian Fainelli 提交于
      If we do not have a master network device attached dst->cpu_dp will be
      NULL and accessing cpu_dp->netdev will create a trace similar to the one
      below. The correct check is on dst->cpu_dp period.
      
      [    1.004650] DSA: switch 0 0 parsed
      [    1.008078] Unable to handle kernel NULL pointer dereference at
      virtual address 00000010
      [    1.016195] pgd = c0003000
      [    1.018918] [00000010] *pgd=80000000004003, *pmd=00000000
      [    1.024349] Internal error: Oops: 206 [#1] SMP ARM
      [    1.029157] Modules linked in:
      [    1.032228] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
      4.13.0-rc6-00071-g45b45afab9bd-dirty #7
      [    1.040772] Hardware name: Broadcom STB (Flattened Device Tree)
      [    1.046704] task: ee08f840 task.stack: ee090000
      [    1.051258] PC is at dsa_register_switch+0x5e0/0x9dc
      [    1.056234] LR is at dsa_register_switch+0x5d0/0x9dc
      [    1.061211] pc : [<c08fb28c>]    lr : [<c08fb27c>]    psr: 60000213
      [    1.067491] sp : ee091d88  ip : 00000000  fp : 0000000c
      [    1.072728] r10: 00000000  r9 : 00000001  r8 : ee208010
      [    1.077965] r7 : ee2b57b0  r6 : ee2b5780  r5 : 00000000  r4 :
      ee208e0c
      [    1.084506] r3 : 00000000  r2 : 00040d00  r1 : 2d1b2000  r0 :
      00000016
      [    1.091050] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
      Segment user
      [    1.098199] Control: 32c5387d  Table: 00003000  DAC: fffffffd
      [    1.103957] Process swapper/0 (pid: 1, stack limit = 0xee090210)
      Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
      Fixes: 6d3c8c0d ("net: dsa: Remove master_netdev and use dst->cpu_dp->netdev")
      Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c7848399
    • R
      bridge: check for null fdb->dst before notifying switchdev drivers · ef9a5a62
      Roopa Prabhu 提交于
      current switchdev drivers dont seem to support offloading fdb
      entries pointing to the bridge device which have fdb->dst
      not set to any port. This patch adds a NULL fdb->dst check in
      the switchdev notifier code.
      
      This patch fixes the below NULL ptr dereference:
      $bridge fdb add 00:02:00:00:00:33 dev br0 self
      
      [   69.953374] BUG: unable to handle kernel NULL pointer dereference at
      0000000000000008
      [   69.954044] IP: br_switchdev_fdb_notify+0x29/0x80
      [   69.954044] PGD 66527067
      [   69.954044] P4D 66527067
      [   69.954044] PUD 7899c067
      [   69.954044] PMD 0
      [   69.954044]
      [   69.954044] Oops: 0000 [#1] SMP
      [   69.954044] Modules linked in:
      [   69.954044] CPU: 1 PID: 3074 Comm: bridge Not tainted 4.13.0-rc6+ #1
      [   69.954044] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
      BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org
      04/01/2014
      [   69.954044] task: ffff88007b827140 task.stack: ffffc90001564000
      [   69.954044] RIP: 0010:br_switchdev_fdb_notify+0x29/0x80
      [   69.954044] RSP: 0018:ffffc90001567918 EFLAGS: 00010246
      [   69.954044] RAX: 0000000000000000 RBX: ffff8800795e0880 RCX:
      00000000000000c0
      [   69.954044] RDX: ffffc90001567920 RSI: 000000000000001c RDI:
      ffff8800795d0600
      [   69.954044] RBP: ffffc90001567938 R08: ffff8800795d0600 R09:
      0000000000000000
      [   69.954044] R10: ffffc90001567a88 R11: ffff88007b849400 R12:
      ffff8800795e0880
      [   69.954044] R13: ffff8800795d0600 R14: ffffffff81ef8880 R15:
      000000000000001c
      [   69.954044] FS:  00007f93d3085700(0000) GS:ffff88007fd00000(0000)
      knlGS:0000000000000000
      [   69.954044] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   69.954044] CR2: 0000000000000008 CR3: 0000000066551000 CR4:
      00000000000006e0
      [   69.954044] Call Trace:
      [   69.954044]  fdb_notify+0x3f/0xf0
      [   69.954044]  __br_fdb_add.isra.12+0x1a7/0x370
      [   69.954044]  br_fdb_add+0x178/0x280
      [   69.954044]  rtnl_fdb_add+0x10a/0x200
      [   69.954044]  rtnetlink_rcv_msg+0x1b4/0x240
      [   69.954044]  ? skb_free_head+0x21/0x40
      [   69.954044]  ? rtnl_calcit.isra.18+0xf0/0xf0
      [   69.954044]  netlink_rcv_skb+0xed/0x120
      [   69.954044]  rtnetlink_rcv+0x15/0x20
      [   69.954044]  netlink_unicast+0x180/0x200
      [   69.954044]  netlink_sendmsg+0x291/0x370
      [   69.954044]  ___sys_sendmsg+0x180/0x2e0
      [   69.954044]  ? filemap_map_pages+0x2db/0x370
      [   69.954044]  ? do_wp_page+0x11d/0x420
      [   69.954044]  ? __handle_mm_fault+0x794/0xd80
      [   69.954044]  ? vma_link+0xcb/0xd0
      [   69.954044]  __sys_sendmsg+0x4c/0x90
      [   69.954044]  SyS_sendmsg+0x12/0x20
      [   69.954044]  do_syscall_64+0x63/0xe0
      [   69.954044]  entry_SYSCALL64_slow_path+0x25/0x25
      [   69.954044] RIP: 0033:0x7f93d2bad690
      [   69.954044] RSP: 002b:00007ffc7217a638 EFLAGS: 00000246 ORIG_RAX:
      000000000000002e
      [   69.954044] RAX: ffffffffffffffda RBX: 00007ffc72182eac RCX:
      00007f93d2bad690
      [   69.954044] RDX: 0000000000000000 RSI: 00007ffc7217a670 RDI:
      0000000000000003
      [   69.954044] RBP: 0000000059a1f7f8 R08: 0000000000000006 R09:
      000000000000000a
      [   69.954044] R10: 00007ffc7217a400 R11: 0000000000000246 R12:
      00007ffc7217a670
      [   69.954044] R13: 00007ffc72182a98 R14: 00000000006114c0 R15:
      00007ffc72182aa0
      [   69.954044] Code: 1f 00 66 66 66 66 90 55 48 89 e5 48 83 ec 20 f6 47
      20 04 74 0a 83 fe 1c 74 09 83 fe 1d 74 2c c9 66 90 c3 48 8b 47 10 48 8d
      55 e8 <48> 8b 70 08 0f b7 47 1e 48 83 c7 18 48 89 7d f0 bf 03 00 00 00
      [   69.954044] RIP: br_switchdev_fdb_notify+0x29/0x80 RSP:
      ffffc90001567918
      [   69.954044] CR2: 0000000000000008
      [   69.954044] ---[ end trace 03e9eec4a82c238b ]---
      
      Fixes: 6b26b51b ("net: bridge: Add support for notifying devices about FDB add/del")
      Signed-off-by: NRoopa Prabhu <roopa@cumulusnetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ef9a5a62
    • X
      ipv6: set dst.obsolete when a cached route has expired · 1e2ea8ad
      Xin Long 提交于
      Now it doesn't check for the cached route expiration in ipv6's
      dst_ops->check(), because it trusts dst_gc that would clean the
      cached route up when it's expired.
      
      The problem is in dst_gc, it would clean the cached route only
      when it's refcount is 1. If some other module (like xfrm) keeps
      holding it and the module only release it when dst_ops->check()
      fails.
      
      But without checking for the cached route expiration, .check()
      may always return true. Meanwhile, without releasing the cached
      route, dst_gc couldn't del it. It will cause this cached route
      never to expire.
      
      This patch is to set dst.obsolete with DST_OBSOLETE_KILL in .gc
      when it's expired, and check obsolete != DST_OBSOLETE_FORCE_CHK
      in .check.
      
      Note that this is even needed when ipv6 dst_gc timer is removed
      one day. It would set dst.obsolete in .redirect and .update_pmtu
      instead, and check for cached route expiration when getting it,
      just like what ipv4 route does.
      Reported-by: NJianlin Shi <jishi@redhat.com>
      Signed-off-by: NXin Long <lucien.xin@gmail.com>
      Acked-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1e2ea8ad
    • W
      ipv6: fix sparse warning on rt6i_node · 4e587ea7
      Wei Wang 提交于
      Commit c5cff856 adds rcu grace period before freeing fib6_node. This
      generates a new sparse warning on rt->rt6i_node related code:
        net/ipv6/route.c:1394:30: error: incompatible types in comparison
        expression (different address spaces)
        ./include/net/ip6_fib.h:187:14: error: incompatible types in comparison
        expression (different address spaces)
      
      This commit adds "__rcu" tag for rt6i_node and makes sure corresponding
      rcu API is used for it.
      After this fix, sparse no longer generates the above warning.
      
      Fixes: c5cff856 ("ipv6: add rcu grace period before freeing fib6_node")
      Signed-off-by: NWei Wang <weiwan@google.com>
      Acked-by: NEric Dumazet <edumazet@google.com>
      Acked-by: NMartin KaFai Lau <kafai@fb.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4e587ea7
    • S
      cxgb4: Fix stack out-of-bounds read due to wrong size to t4_record_mbox() · 0f308686
      Stefano Brivio 提交于
      Passing commands for logging to t4_record_mbox() with size
      MBOX_LEN, when the actual command size is actually smaller,
      causes out-of-bounds stack accesses in t4_record_mbox() while
      copying command words here:
      
      	for (i = 0; i < size / 8; i++)
      		entry->cmd[i] = be64_to_cpu(cmd[i]);
      
      Up to 48 bytes from the stack are then leaked to debugfs.
      
      This happens whenever we send (and log) commands described by
      structs fw_sched_cmd (32 bytes leaked), fw_vi_rxmode_cmd (48),
      fw_hello_cmd (48), fw_bye_cmd (48), fw_initialize_cmd (48),
      fw_reset_cmd (48), fw_pfvf_cmd (32), fw_eq_eth_cmd (16),
      fw_eq_ctrl_cmd (32), fw_eq_ofld_cmd (32), fw_acl_mac_cmd(16),
      fw_rss_glb_config_cmd(32), fw_rss_vi_config_cmd(32),
      fw_devlog_cmd(32), fw_vi_enable_cmd(48), fw_port_cmd(32),
      fw_sched_cmd(32), fw_devlog_cmd(32).
      
      The cxgb4vf driver got this right instead.
      
      When we call t4_record_mbox() to log a command reply, a MBOX_LEN
      size can be used though, as get_mbox_rpl() will fill cmd_rpl up
      completely.
      
      Fixes: 7f080c3f ("cxgb4: Add support to enable logging of firmware mailbox commands")
      Signed-off-by: NStefano Brivio <sbrivio@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0f308686
    • M
      net: stmmac: sun8i: Remove the compatibles · ad4540cc
      Maxime Ripard 提交于
      Since the bindings have been controversial, and we follow the DT stable ABI
      rule, we shouldn't let a driver with a DT binding that might change slip
      through in a stable release.
      
      Remove the compatibles to make sure the driver will not probe and no-one
      will start using the binding currently implemented. This commit will
      obviously need to be reverted in due time.
      Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ad4540cc
    • D
      Merge branch 'nfp-flow-dissector-layer' · c73c8a8e
      David S. Miller 提交于
      Pieter Jansen van Vuuren says:
      
      ====================
      nfp: fix layer calculation and flow dissector use
      
      Previously when calculating the supported key layers MPLS, IPv4/6
      TTL and TOS were not considered. Formerly flow dissectors were referenced
      without first checking that they are in use and correctly populated by TC.
      Additionally this patch set fixes the incorrect use of mask field for vlan
      matching.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      c73c8a8e
    • P
      nfp: remove incorrect mask check for vlan matching · 6afd33e4
      Pieter Jansen van Vuuren 提交于
      Previously the vlan tci field was incorrectly exact matched. This patch
      fixes this by using the flow dissector to populate the vlan tci field.
      
      Fixes: 5571e8c9 ("nfp: extend flower matching capabilities")
      Signed-off-by: NPieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
      Reviewed-by: NJakub Kicinski <jakub.kicinski@netronome.com>
      Reviewed-by: NSimon Horman <simon.horman@netronome.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6afd33e4
    • P
      nfp: fix supported key layers calculation · 74af5975
      Pieter Jansen van Vuuren 提交于
      Previously when calculating the supported key layers MPLS, IPv4/6
      TTL and TOS were not considered. This patch checks that the TTL and
      TOS fields are masked out before offloading. Additionally this patch
      checks that MPLS packets are correctly handled, by not offloading them.
      
      Fixes: af9d842c ("nfp: extend flower add flow offload")
      Signed-off-by: NPieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
      Reviewed-by: NJakub Kicinski <jakub.kicinski@netronome.com>
      Reviewed-by: NSimon Horman <simon.horman@netronome.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      74af5975
    • P
      nfp: fix unchecked flow dissector use · a7cd39e0
      Pieter Jansen van Vuuren 提交于
      Previously flow dissectors were referenced without first checking that
      they are in use and correctly populated by TC. This patch fixes this by
      checking each flow dissector key before referencing them.
      
      Fixes: 5571e8c9 ("nfp: extend flower matching capabilities")
      Signed-off-by: NPieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
      Reviewed-by: NJakub Kicinski <jakub.kicinski@netronome.com>
      Reviewed-by: NSimon Horman <simon.horman@netronome.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a7cd39e0
    • D
      Merge branch 'l2tp-tunnel-refs' · 77146b5d
      David S. Miller 提交于
      Guillaume Nault says:
      
      ====================
      l2tp: fix some l2tp_tunnel_find() issues in l2tp_netlink
      
      Since l2tp_tunnel_find() doesn't take a reference on the tunnel it
      returns, its users are almost guaranteed to be racy.
      
      This series defines l2tp_tunnel_get() which can be used as a safe
      replacement, and converts some of l2tp_tunnel_find() users in the
      l2tp_netlink module.
      
      Other users often combine this issue with other more or less subtle
      races. They will be fixed incrementally in followup series.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      77146b5d
    • G
      l2tp: hold tunnel used while creating sessions with netlink · e702c120
      Guillaume Nault 提交于
      Use l2tp_tunnel_get() to retrieve tunnel, so that it can't go away on
      us. Otherwise l2tp_tunnel_destruct() might release the last reference
      count concurrently, thus freeing the tunnel while we're using it.
      
      Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e702c120
    • G
      l2tp: hold tunnel while handling genl TUNNEL_GET commands · 4e4b21da
      Guillaume Nault 提交于
      Use l2tp_tunnel_get() instead of l2tp_tunnel_find() so that we get
      a reference on the tunnel, preventing l2tp_tunnel_destruct() from
      freeing it from under us.
      
      Also move l2tp_tunnel_get() below nlmsg_new() so that we only take
      the reference when needed.
      
      Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4e4b21da
    • G
      l2tp: hold tunnel while handling genl tunnel updates · 8c0e4215
      Guillaume Nault 提交于
      We need to make sure the tunnel is not going to be destroyed by
      l2tp_tunnel_destruct() concurrently.
      
      Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8c0e4215
    • G
      l2tp: hold tunnel while processing genl delete command · bb0a32ce
      Guillaume Nault 提交于
      l2tp_nl_cmd_tunnel_delete() needs to take a reference on the tunnel, to
      prevent it from being concurrently freed by l2tp_tunnel_destruct().
      
      Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bb0a32ce
    • G
      l2tp: hold tunnel while looking up sessions in l2tp_netlink · 54652eb1
      Guillaume Nault 提交于
      l2tp_tunnel_find() doesn't take a reference on the returned tunnel.
      Therefore, it's unsafe to use it because the returned tunnel can go
      away on us anytime.
      
      Fix this by defining l2tp_tunnel_get(), which works like
      l2tp_tunnel_find(), but takes a reference on the returned tunnel.
      Caller then has to drop this reference using l2tp_tunnel_dec_refcount().
      
      As l2tp_tunnel_dec_refcount() needs to be moved to l2tp_core.h, let's
      simplify the patch and not move the L2TP_REFCNT_DEBUG part. This code
      has been broken (not even compiling) in May 2012 by
      commit a4ca44fa ("net: l2tp: Standardize logging styles")
      and fixed more than two years later by
      commit 29abe2fd ("l2tp: fix missing line continuation"). So it
      doesn't appear to be used by anyone.
      
      Same thing for l2tp_tunnel_free(); instead of moving it to l2tp_core.h,
      let's just simplify things and call kfree_rcu() directly in
      l2tp_tunnel_dec_refcount(). Extra assertions and debugging code
      provided by l2tp_tunnel_free() didn't help catching any of the
      reference counting and socket handling issues found while working on
      this series.
      
      Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      54652eb1
    • G
      l2tp: initialise session's refcount before making it reachable · 9ee369a4
      Guillaume Nault 提交于
      Sessions must be fully initialised before calling
      l2tp_session_add_to_tunnel(). Otherwise, there's a short time frame
      where partially initialised sessions can be accessed by external users.
      
      Fixes: dbdbc73b ("l2tp: fix duplicate session creation")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9ee369a4
    • A
      net: mvpp2: fix the mac address used when using PPv2.2 · 4c228682
      Antoine Tenart 提交于
      The mac address is only retrieved from h/w when using PPv2.1. Otherwise
      the variable holding it is still checked and used if it contains a valid
      value. As the variable isn't initialized to an invalid mac address
      value, we end up with random mac addresses which can be the same for all
      the ports handled by this PPv2 driver.
      
      Fixes this by initializing the h/w mac address variable to {0}, which is
      an invalid mac address value. This way the random assignation fallback
      is called and all ports end up with their own addresses.
      Signed-off-by: NAntoine Tenart <antoine.tenart@free-electrons.com>
      Fixes: 26975821 ("net: mvpp2: handle misc PPv2.1/PPv2.2 differences")
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4c228682
    • A
      cdc_ncm: flag the u-blox TOBY-L4 as wwan · 3b638f0f
      Aleksander Morgado 提交于
      The u-blox TOBY-L4 is a LTE Advanced (Cat 6) module with HSPA+ and 2G
      fallback.
      
      Unlike the TOBY-L2, this module has one single USB layout and exposes
      several TTYs for control and a NCM interface for data. Connecting this
      module may be done just by activating the desired PDP context with
      'AT+CGACT=1,<cid>' and then running DHCP on the NCM interface.
      Signed-off-by: NAleksander Morgado <aleksander@aleksander.es>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3b638f0f
    • J
      net: missing call of trace_napi_poll in busy_poll_stop · 1e22391e
      Jesper Dangaard Brouer 提交于
      Noticed that busy_poll_stop() also invoke the drivers napi->poll()
      function pointer, but didn't have an associated call to trace_napi_poll()
      like all other call sites.
      Signed-off-by: NJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      1e22391e
  3. 28 8月, 2017 4 次提交
  4. 26 8月, 2017 8 次提交
  5. 25 8月, 2017 7 次提交