1. 22 7月, 2016 1 次提交
    • F
      netfilter: conntrack: support a fixed size of 128 distinct labels · 23014011
      Florian Westphal 提交于
      The conntrack label extension is currently variable-sized, e.g. if
      only 2 labels are used by iptables rules then the labels->bits[] array
      will only contain one element.
      
      We track size of each label storage area in the 'words' member.
      
      But in nftables and openvswitch we always have to ask for worst-case
      since we don't know what bit will be used at configuration time.
      
      As most arches are 64bit we need to allocate 24 bytes in this case:
      
      struct nf_conn_labels {
          u8            words;   /*     0     1 */
          /* XXX 7 bytes hole, try to pack */
          long unsigned bits[2]; /*     8     24 */
      
      Make bits a fixed size and drop the words member, it simplifies
      the code and only increases memory requirements on x86 when
      less than 64bit labels are required.
      
      We still only allocate the extension if its needed.
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      23014011
  2. 21 7月, 2016 5 次提交
  3. 20 7月, 2016 1 次提交
  4. 19 7月, 2016 1 次提交
    • F
      netfilter: x_tables: speed up jump target validation · f4dc7771
      Florian Westphal 提交于
      The dummy ruleset I used to test the original validation change was broken,
      most rules were unreachable and were not tested by mark_source_chains().
      
      In some cases rulesets that used to load in a few seconds now require
      several minutes.
      
      sample ruleset that shows the behaviour:
      
      echo "*filter"
      for i in $(seq 0 100000);do
              printf ":chain_%06x - [0:0]\n" $i
      done
      for i in $(seq 0 100000);do
         printf -- "-A INPUT -j chain_%06x\n" $i
         printf -- "-A INPUT -j chain_%06x\n" $i
         printf -- "-A INPUT -j chain_%06x\n" $i
      done
      echo COMMIT
      
      [ pipe result into iptables-restore ]
      
      This ruleset will be about 74mbyte in size, with ~500k searches
      though all 500k[1] rule entries. iptables-restore will take forever
      (gave up after 10 minutes)
      
      Instead of always searching the entire blob for a match, fill an
      array with the start offsets of every single ipt_entry struct,
      then do a binary search to check if the jump target is present or not.
      
      After this change ruleset restore times get again close to what one
      gets when reverting 36472341 (~3 seconds on my workstation).
      
      [1] every user-defined rule gets an implicit RETURN, so we get
      300k jumps + 100k userchains + 100k returns -> 500k rule entries
      
      Fixes: 36472341 ("netfilter: x_tables: validate targets of jumps")
      Reported-by: NJeff Wu <wujiafu@gmail.com>
      Tested-by: NJeff Wu <wujiafu@gmail.com>
      Signed-off-by: NFlorian Westphal <fw@strlen.de>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      f4dc7771
  5. 12 7月, 2016 1 次提交
  6. 11 7月, 2016 12 次提交
  7. 08 7月, 2016 1 次提交
    • M
      ipvs: count pre-established TCP states as active · be2cef49
      Michal Kubecek 提交于
      Some users observed that "least connection" distribution algorithm doesn't
      handle well bursts of TCP connections from reconnecting clients after
      a node or network failure.
      
      This is because the algorithm counts active connection as worth 256
      inactive ones where for TCP, "active" only means TCP connections in
      ESTABLISHED state. In case of a connection burst, new connections are
      handled before previous ones have finished the three way handshaking so
      that all are still counted as "inactive", i.e. cheap ones. The become
      "active" quickly but at that time, all of them are already assigned to one
      real server (or few), resulting in highly unbalanced distribution.
      
      Address this by counting the "pre-established" states as "active".
      Signed-off-by: NMichal Kubecek <mkubecek@suse.cz>
      Acked-by: NJulian Anastasov <ja@ssi.bg>
      Signed-off-by: NSimon Horman <horms@verge.net.au>
      be2cef49
  8. 07 7月, 2016 7 次提交
    • D
      Merge tag 'mac80211-next-for-davem-2016-07-06' of... · a90a6e55
      David S. Miller 提交于
      Merge tag 'mac80211-next-for-davem-2016-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
      
      Johannes Berg says:
      
      ====================
      One more set of new features:
       * beacon report (for radio measurement) support in cfg80211/mac80211
       * hwsim: allow wmediumd in namespaces
       * mac80211: extend 160MHz workaround to CSA IEs
       * mesh: properly encrypt group-addressed privacy action frames
       * mesh: allow setting peer AID
       * first steps for MU-MIMO monitor mode
       * along with various other cleanups and improvements
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a90a6e55
    • W
      net: mediatek: remove .owner field for driver · fcf752ae
      Wei Yongjun 提交于
      Remove .owner field since calls to module_platform_driver() will
      set it automatically.
      Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fcf752ae
    • D
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 30d0844b
      David S. Miller 提交于
      Conflicts:
      	drivers/net/ethernet/mellanox/mlx5/core/en.h
      	drivers/net/ethernet/mellanox/mlx5/core/en_main.c
      	drivers/net/usb/r8152.c
      
      All three conflicts were overlapping changes.
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      30d0844b
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · bc867651
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
       1) All users of AF_PACKET's fanout feature want a symmetric packet
          header hash for load balancing purposes, so give it to them.
      
       2) Fix vlan state synchronization in e1000e, from Jarod Wilson.
      
       3) Use correct socket pointer in ip_skb_dst_mtu(), from Shmulik
          Ladkani.
      
       4) mlx5 bug fixes from Mohamad Haj Yahia, Daniel Jurgens, Matthew
          Finlay, Rana Shahout, and Shaker Daibes.  Mostly to do with
          operation timeouts and PCI error handling.
      
       5) Fix checksum handling in mirred packet action, from WANG Cong.
      
       6) Set skb->dev correctly when transmitting in !protect_frames case of
          macsec driver, from Daniel Borkmann.
      
       7) Fix MTU calculation in geneve driver, from Haishuang Yan.
      
       8) Missing netif_napi_del() in unregister path of qeth driver, from
          Ursula Braun.
      
       9) Handle malformed route netlink messages in decnet properly, from
          Vergard Nossum.
      
      10) Memory leak of percpu data in ipv6 routing code, from Martin KaFai
          Lau.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits)
        ipv6: Fix mem leak in rt6i_pcpu
        net: fix decnet rtnexthop parsing
        cxgb4: update latest firmware version supported
        net/mlx5: Avoid setting unused var when modifying vport node GUID
        bonding: fix enslavement slave link notifications
        r8152: fix runtime function for RTL8152
        qeth: delete napi struct when removing a qeth device
        Revert "fsl/fman: fix error handling"
        fsl/fman: fix error handling
        cdc_ncm: workaround for EM7455 "silent" data interface
        RDS: fix rds_tcp_init() error path
        geneve: fix max_mtu setting
        net: phy: dp83867: Fix initialization of PHYCR register
        enc28j60: Fix race condition in enc28j60 driver
        net: stmmac: Fix null-function call in ISR on stmmac1000
        tipc: fix nl compat regression for link statistics
        net: bcmsysport: Device stats are unsigned long
        macsec: set actual real device for xmit when !protect_frames
        net_sched: fix mirrored packets checksum
        packet: Use symmetric hash for PACKET_FANOUT_HASH.
        ...
      bc867651
    • D
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next · ae3e4562
      David S. Miller 提交于
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter updates for net-next
      
      The following patchset contains Netfilter updates for net-next,
      they are:
      
      1) Don't use userspace datatypes in bridge netfilter code, from
         Tobin Harding.
      
      2) Iterate only once over the expectation table when removing the
         helper module, instead of once per-netns, from Florian Westphal.
      
      3) Extra sanitization in xt_hook_ops_alloc() to return error in case
         we ever pass zero hooks, xt_hook_ops_alloc():
      
      4) Handle NFPROTO_INET from the logging core infrastructure, from
         Liping Zhang.
      
      5) Autoload loggers when TRACE target is used from rules, this doesn't
         change the behaviour in case the user already selected nfnetlink_log
         as preferred way to print tracing logs, also from Liping Zhang.
      
      6) Conntrack slabs with SLAB_HWCACHE_ALIGN to allow rearranging fields
         by cache lines, increases the size of entries in 11% per entry.
         From Florian Westphal.
      
      7) Skip zone comparison if CONFIG_NF_CONNTRACK_ZONES=n, from Florian.
      
      8) Remove useless defensive check in nf_logger_find_get() from Shivani
         Bhardwaj.
      
      9) Remove zone extension as place it in the conntrack object, this is
         always include in the hashing and we expect more intensive use of
         zones since containers are in place. Also from Florian Westphal.
      
      10) Owner match now works from any namespace, from Eric Bierdeman.
      
      11) Make sure we only reply with TCP reset to TCP traffic from
          nf_reject_ipv4, patch from Liping Zhang.
      
      12) Introduce --nflog-size to indicate amount of network packet bytes
          that are copied to userspace via log message, from Vishwanath Pai.
          This obsoletes --nflog-range that has never worked, it was designed
          to achieve this but it has never worked.
      
      13) Introduce generic macros for nf_tables object generation masks.
      
      14) Use generation mask in table, chain and set objects in nf_tables.
          This allows fixes interferences with ongoing preparation phase of
          the commit protocol and object listings going on at the same time.
          This update is introduced in three patches, one per object.
      
      15) Check if the object is active in the next generation for element
          deactivation in the rbtree implementation, given that deactivation
          happens from the commit phase path we have to observe the future
          status of the object.
      
      16) Support for deletion of just added elements in the hash set type.
      
      17) Allow to resize hashtable from /proc entry, not only from the
          obscure /sys entry that maps to the module parameter, from Florian
          Westphal.
      
      18) Get rid of NFT_BASECHAIN_DISABLED, this code is not exercised
          anymore since we tear down the ruleset whenever the netdevice
          goes away.
      
      19) Support for matching inverted set lookups, from Arturo Borrero.
      
      20) Simplify the iptables_mangle_hook() by removing a superfluous
          extra branch.
      
      21) Introduce ether_addr_equal_masked() and use it from the netfilter
          codebase, from Joe Perches.
      
      22) Remove references to "Use netfilter MARK value as routing key"
          from the Netfilter Kconfig description given that this toggle
          doesn't exists already for 10 years, from Moritz Sichert.
      
      23) Introduce generic NF_INVF() and use it from the xtables codebase,
          from Joe Perches.
      
      24) Setting logger to NONE via /proc was not working unless explicit
          nul-termination was included in the string. This fixes seems to
          leave the former behaviour there, so we don't break backward.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      ae3e4562
    • L
      Merge tag 'sound-4.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 4cdbbbd1
      Linus Torvalds 提交于
      Pull sound fixes from Takashi Iwai:
       "Here are a collection of small fixes: at this time, we've got a
        slightly high amount, but all small and trivial fixes, and nothing
        scary can be seen there"
      
      * tag 'sound-4.7-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits)
        ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
        ALSA: timer: Fix negative queue usage by racy accesses
        ASoC: rt5645: fix reg-2f default value.
        ASoC: fsl_ssi: Fix number of words per frame for I2S-slave mode
        ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
        ALSA: hda - Add PCI ID for Kabylake-H
        ALSA: echoaudio: Fix memory allocation
        ASoC: Intel: atom: fix missing breaks that would cause the wrong operation to execute
        ALSA: hda - fix read before array start
        ASoC: cx20442: set tty->receiver_room in v253_open
        ASoC: ak4613: Enable cache usage to fix crashes on resume
        ASoC: wm8940: Enable cache usage to fix crashes on resume
        ASoC: Intel: Skylake: Initialize module list for Broxton
        ASoC: wm5102: Correct supported channels on trace compressed DAI
        ASoC: wm5110: Add missing route from OUT3R to SYSCLK
        ASoC: rt5670: fix HP Playback Volume control
        ASoC: hdmi-codec: select CONFIG_HDMI
        ASoC: davinci-mcasp: Fix dra7 DMA offset when using CFG port
        ASoC: hdac_hdmi: Fix potential NULL dereference
        ASoC: ak4613: Remove owner assignment from platform_driver
        ...
      4cdbbbd1
    • L
      Merge tag 'chrome-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/olof/chrome-platform · 4d0a279c
      Linus Torvalds 提交于
      Pull chrome platform fix from Olof Johansson:
       "A single fix this time, closing a window where ioctl args are fetched
        twice"
      
      * tag 'chrome-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/olof/chrome-platform:
        platform/chrome: cros_ec_dev - double fetch bug in ioctl
      4d0a279c
  9. 06 7月, 2016 11 次提交