1. 17 10月, 2017 1 次提交
  2. 10 10月, 2017 2 次提交
  3. 09 10月, 2017 6 次提交
  4. 07 10月, 2017 1 次提交
    • G
      ppp: fix race in ppp device destruction · 6151b8b3
      Guillaume Nault 提交于
      ppp_release() tries to ensure that netdevices are unregistered before
      decrementing the unit refcount and running ppp_destroy_interface().
      
      This is all fine as long as the the device is unregistered by
      ppp_release(): the unregister_netdevice() call, followed by
      rtnl_unlock(), guarantee that the unregistration process completes
      before rtnl_unlock() returns.
      
      However, the device may be unregistered by other means (like
      ppp_nl_dellink()). If this happens right before ppp_release() calling
      rtnl_lock(), then ppp_release() has to wait for the concurrent
      unregistration code to release the lock.
      But rtnl_unlock() releases the lock before completing the device
      unregistration process. This allows ppp_release() to proceed and
      eventually call ppp_destroy_interface() before the unregistration
      process completes. Calling free_netdev() on this partially unregistered
      device will BUG():
      
       ------------[ cut here ]------------
       kernel BUG at net/core/dev.c:8141!
       invalid opcode: 0000 [#1] SMP
      
       CPU: 1 PID: 1557 Comm: pppd Not tainted 4.14.0-rc2+ #4
       Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
      
       Call Trace:
        ppp_destroy_interface+0xd8/0xe0 [ppp_generic]
        ppp_disconnect_channel+0xda/0x110 [ppp_generic]
        ppp_unregister_channel+0x5e/0x110 [ppp_generic]
        pppox_unbind_sock+0x23/0x30 [pppox]
        pppoe_connect+0x130/0x440 [pppoe]
        SYSC_connect+0x98/0x110
        ? do_fcntl+0x2c0/0x5d0
        SyS_connect+0xe/0x10
        entry_SYSCALL_64_fastpath+0x1a/0xa5
      
       RIP: free_netdev+0x107/0x110 RSP: ffffc28a40573d88
       ---[ end trace ed294ff0cc40eeff ]---
      
      We could set the ->needs_free_netdev flag on PPP devices and move the
      ppp_destroy_interface() logic in the ->priv_destructor() callback. But
      that'd be quite intrusive as we'd first need to unlink from the other
      channels and units that depend on the device (the ones that used the
      PPPIOCCONNECT and PPPIOCATTACH ioctls).
      
      Instead, we can just let the netdevice hold a reference on its
      ppp_file. This reference is dropped in ->priv_destructor(), at the very
      end of the unregistration process, so that neither ppp_release() nor
      ppp_disconnect_channel() can call ppp_destroy_interface() in the interim.
      Reported-by: NBeniamino Galvani <bgalvani@redhat.com>
      Fixes: 8cb775bc ("ppp: fix device unregistration upon netns deletion")
      Signed-off-by: NGuillaume Nault <g.nault@alphalink.fr>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6151b8b3
  5. 04 10月, 2017 2 次提交
    • D
      net: stmmac: dwmac-rk: Add RK3128 GMAC support · 05946876
      David Wu 提交于
      Add constants and callback functions for the dwmac on rk3128 soc.
      As can be seen, the base structure is the same, only registers
      and the bits in them moved slightly.
      Signed-off-by: NDavid Wu <david.wu@rock-chips.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      05946876
    • A
      rndis_host: support Novatel Verizon USB730L · 63ba395c
      Aleksander Morgado 提交于
      Treat the ef/04/01 interface class/subclass/protocol combination used
      by the Novatel Verizon USB730L (1410:9030) as a possible RNDIS
      interface.
      
       T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#= 17 Spd=480 MxCh= 0
       D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  3
       P:  Vendor=1410 ProdID=9030 Rev=03.10
       S:  Manufacturer=Novatel Wireless
       S:  Product=MiFi USB730L
       S:  SerialNumber=0123456789ABCDEF
       C:  #Ifs= 3 Cfg#= 1 Atr=80 MxPwr=500mA
       I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
       I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
       I:  If#= 2 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
      
      Once the network interface is brought up, the user just needs to run a
      DHCP client to get IP address and routing setup.
      
      As a side note, other Novatel Verizon USB730L models with the same
      vid:pid end up exposing a standard ECM interface which doesn't require
      any other kernel update to make it work.
      Signed-off-by: NAleksander Morgado <aleksander@aleksander.es>
      Reviewed-by: NBjørn Mork <bjorn@mork.no>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      63ba395c
  6. 03 10月, 2017 2 次提交
    • P
      mlxsw: spectrum_router: Track RIF of IPIP next hops · de0f43c0
      Petr Machata 提交于
      When considering whether to set RTNH_F_OFFLOAD flag on an IPv6 route,
      mlxsw_sp_fib6_entry_offload_set() looks up the mlxsw_sp_nexthop
      corresponding to a given route, and decides based on whether the next
      hop's offloaded flag was set. When looking for the matching next hop, it
      also takes into account the device of the route, which must match next
      hop's RIF.
      
      IPIP next hops however hitherto didn't set the RIF. As a result, IPv6
      routes forwarding traffic to IP-in-IP netdevices are never marked as
      offloaded, even when they actually are.
      
      Thus track RIF of IPIP next hops the same way as that of ETHERNET next
      hops.
      
      Fixes: 8f28a309 ("mlxsw: spectrum_router: Support IPv6 overlay encap")
      Signed-off-by: NPetr Machata <petrm@mellanox.com>
      Reviewed-by: NIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      de0f43c0
    • P
      mlxsw: spectrum_router: Move VRF refcounting · 28a04c7b
      Petr Machata 提交于
      When creating a new RIF, bumping RIF count of the containing VR is the
      last thing to be done. Symmetrically, when destroying a RIF, RIF count
      is first dropped and only then the rest of the cleanup proceeds.
      
      That's a problem for loopback RIFs. Those hold two VR references: one
      for overlay and one for underlay. mlxsw_sp_rif_destroy() releases the
      overlay one, and the deconfigure() callback the underlay one. But if
      both overlay and underlay are the same, and if there are no other
      artifacts holding the VR alive, this put actually destroys the VR. Later
      on, when mlxsw_sp_rif_destroy() calls mlxsw_sp_vr_put() for the same VR,
      the VR will already have been released and the kernel crashes with NULL
      pointer dereference.
      
      The underlying problem is that the RIF under destruction ends up
      referencing the overlay VR much longer than it claims: all the way until
      the call to mlxsw_sp_vr_put(). So line up the reference counting
      properly to reflect this. Make corresponding changes in
      mlxsw_sp_rif_create() as well for symmetry.
      
      Fixes: 6ddb7426 ("mlxsw: spectrum_router: Introduce loopback RIFs")
      Signed-off-by: NPetr Machata <petrm@mellanox.com>
      Reviewed-by: NIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: NJiri Pirko <jiri@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      28a04c7b
  7. 02 10月, 2017 3 次提交
  8. 01 10月, 2017 1 次提交
  9. 29 9月, 2017 7 次提交
  10. 28 9月, 2017 12 次提交
  11. 27 9月, 2017 3 次提交