1. 17 7月, 2012 1 次提交
    • L
      ipvs: fix oops on NAT reply in br_nf context · 9e33ce45
      Lin Ming 提交于
      IPVS should not reset skb->nf_bridge in FORWARD hook
      by calling nf_reset for NAT replies. It triggers oops in
      br_nf_forward_finish.
      
      [  579.781508] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
      [  579.781669] IP: [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
      [  579.781792] PGD 218f9067 PUD 0
      [  579.781865] Oops: 0000 [#1] SMP
      [  579.781945] CPU 0
      [  579.781983] Modules linked in:
      [  579.782047]
      [  579.782080]
      [  579.782114] Pid: 4644, comm: qemu Tainted: G        W    3.5.0-rc5-00006-g95e69f9 #282 Hewlett-Packard  /30E8
      [  579.782300] RIP: 0010:[<ffffffff817b1ca5>]  [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112
      [  579.782455] RSP: 0018:ffff88007b003a98  EFLAGS: 00010287
      [  579.782541] RAX: 0000000000000008 RBX: ffff8800762ead00 RCX: 000000000001670a
      [  579.782653] RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff8800762ead00
      [  579.782845] RBP: ffff88007b003ac8 R08: 0000000000016630 R09: ffff88007b003a90
      [  579.782957] R10: ffff88007b0038e8 R11: ffff88002da37540 R12: ffff88002da01a02
      [  579.783066] R13: ffff88002da01a80 R14: ffff88002d83c000 R15: ffff88002d82a000
      [  579.783177] FS:  0000000000000000(0000) GS:ffff88007b000000(0063) knlGS:00000000f62d1b70
      [  579.783306] CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
      [  579.783395] CR2: 0000000000000004 CR3: 00000000218fe000 CR4: 00000000000027f0
      [  579.783505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  579.783684] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      [  579.783795] Process qemu (pid: 4644, threadinfo ffff880021b20000, task ffff880021aba760)
      [  579.783919] Stack:
      [  579.783959]  ffff88007693cedc ffff8800762ead00 ffff88002da01a02 ffff8800762ead00
      [  579.784110]  ffff88002da01a02 ffff88002da01a80 ffff88007b003b18 ffffffff817b26c7
      [  579.784260]  ffff880080000000 ffffffff81ef59f0 ffff8800762ead00 ffffffff81ef58b0
      [  579.784477] Call Trace:
      [  579.784523]  <IRQ>
      [  579.784562]
      [  579.784603]  [<ffffffff817b26c7>] br_nf_forward_ip+0x275/0x2c8
      [  579.784707]  [<ffffffff81704b58>] nf_iterate+0x47/0x7d
      [  579.784797]  [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
      [  579.784906]  [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
      [  579.784995]  [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae
      [  579.785175]  [<ffffffff8187fa95>] ? _raw_write_unlock_bh+0x19/0x1b
      [  579.785179]  [<ffffffff817ac417>] __br_forward+0x97/0xa2
      [  579.785179]  [<ffffffff817ad366>] br_handle_frame_finish+0x1a6/0x257
      [  579.785179]  [<ffffffff817b2386>] br_nf_pre_routing_finish+0x26d/0x2cb
      [  579.785179]  [<ffffffff817b2cf0>] br_nf_pre_routing+0x55d/0x5c1
      [  579.785179]  [<ffffffff81704b58>] nf_iterate+0x47/0x7d
      [  579.785179]  [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
      [  579.785179]  [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102
      [  579.785179]  [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44
      [  579.785179]  [<ffffffff81551525>] ? sky2_poll+0xb35/0xb54
      [  579.785179]  [<ffffffff817ad62a>] br_handle_frame+0x213/0x229
      [  579.785179]  [<ffffffff817ad417>] ? br_handle_frame_finish+0x257/0x257
      [  579.785179]  [<ffffffff816e3b47>] __netif_receive_skb+0x2b4/0x3f1
      [  579.785179]  [<ffffffff816e69fc>] process_backlog+0x99/0x1e2
      [  579.785179]  [<ffffffff816e6800>] net_rx_action+0xdf/0x242
      [  579.785179]  [<ffffffff8107e8a8>] __do_softirq+0xc1/0x1e0
      [  579.785179]  [<ffffffff8135a5ba>] ? trace_hardirqs_off_thunk+0x3a/0x6c
      [  579.785179]  [<ffffffff8188812c>] call_softirq+0x1c/0x30
      
      The steps to reproduce as follow,
      
      1. On Host1, setup brige br0(192.168.1.106)
      2. Boot a kvm guest(192.168.1.105) on Host1 and start httpd
      3. Start IPVS service on Host1
         ipvsadm -A -t 192.168.1.106:80 -s rr
         ipvsadm -a -t 192.168.1.106:80 -r 192.168.1.105:80 -m
      4. Run apache benchmark on Host2(192.168.1.101)
         ab -n 1000 http://192.168.1.106/
      
      ip_vs_reply4
        ip_vs_out
          handle_response
            ip_vs_notrack
              nf_reset()
              {
                skb->nf_bridge = NULL;
              }
      
      Actually, IPVS wants in this case just to replace nfct
      with untracked version. So replace the nf_reset(skb) call
      in ip_vs_notrack() with a nf_conntrack_put(skb->nfct) call.
      Signed-off-by: NLin Ming <mlin@ss.pku.edu.cn>
      Signed-off-by: NJulian Anastasov <ja@ssi.bg>
      Signed-off-by: NSimon Horman <horms@verge.net.au>
      Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
      9e33ce45
  2. 16 7月, 2012 1 次提交
  3. 12 7月, 2012 1 次提交
  4. 11 7月, 2012 4 次提交
  5. 10 7月, 2012 17 次提交
  6. 09 7月, 2012 12 次提交
  7. 06 7月, 2012 1 次提交
  8. 04 7月, 2012 3 次提交
    • L
      Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux · 9e85a6f9
      Linus Torvalds 提交于
      Pull fix to common clk framework from Michael Turquette:
       "The previous set of common clk fixes for -rc5 left an uninitialized
        int which could lead to bad array indexing when switching clock
        parents.  The issue is fixed with a trivial change to the code flow in
        __clk_set_parent."
      
      * tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux:
        clk: fix parent validation in __clk_set_parent()
      9e85a6f9
    • L
      Merge tag 'md-3.5-fixes' of git://neil.brown.name/md · 6c8addcb
      Linus Torvalds 提交于
      Pull raid10 build failure fix from NeilBrown:
       "I really shouldn't do important things late in the day.  It seems that
        I get careless."
      
      * tag 'md-3.5-fixes' of git://neil.brown.name/md:
        md/raid10: fix careless build error
      6c8addcb
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 56728748
      Linus Torvalds 提交于
      Pull networking update from David Miller:
      
       1) Fix RX sequence number handling in mwifiex, from Stone Piao.
      
       2) Netfilter ipset mis-compares device names, fix from Florian
          Westphal.
      
       3) Fix route leak in ipv6 IPVS, from Eric Dumazet.
      
       4) NFS fixes.  Several buffer overflows in NCI layer from Dan
          Rosenberg, and release sock OOPS'er fix from Eric Dumazet.
      
       5) Fix WEP handling ath9k, we started using a bit the chip provides to
          indicate undecrypted packets but that bit turns out to be unreliable
          in certain configurations.  Fix from Felix Fietkau.
      
       6) Fix Kconfig dependency bug in wlcore, from Randy Dunlap.
      
       7) New USB IDs for rtlwifi driver from Larry Finger.
      
       8) Fix crashes in qmi_wwan usbnet driver when disconnecting, from Bjørn
          Mork.
      
       9) Gianfar driver programs coalescing settings properly in single queue
          mode, but does not do so in multi-queue mode.  Fix from Claudiu
          Manoil.
      
      10) Missing module.h include in davinci_cpdma.c, from Daniel Mack.
      
      11) Need dummy handler for IPSET_CMD_NONE otherwise we crash in ipset if
          we get this via nfnetlink, fix from Tomasz Bursztyka.
      
      12) Missing RCU unlock in nfnetlink error path, also from Tomasz.
      
      13) Fix divide by zero in igbvf when the user tries to set an RX
          coalescing value of 0 usecs, from Mitch A Williams.
      
      14) We can process SCTP sacks for the wrong transport, oops.  Fix from
          Neil Horman.
      
      15) Remove hw IP payload checksumming from e1000e driver.  This has zery
          value in our stack, and turning it on creates a very unintuitive
          restriction for users when using jumbo MTUs.
      
          Specifically, when IP payload checksums are on you cannot use both
          receive hashing offload and jumbo MTU.  Fix from Bruce Allan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
        e1000e: remove use of IP payload checksum
        sctp: be more restrictive in transport selection on bundled sacks
        igbvf: fix divide by zero
        netfilter: nfnetlink: fix missing rcu_read_unlock in nfnetlink_rcv_msg
        netfilter: ipset: fix crash if IPSET_CMD_NONE command is sent
        davinci_cpdma: include linux/module.h
        gianfar: Fix RXICr/TXICr programming for multi-queue mode
        net: Downgrade CAP_SYS_MODULE deprecated message from error to warning.
        net: qmi_wwan: fix Oops while disconnecting
        mwifiex: fix memory leak associated with IE manamgement
        ath9k: fix panic caused by returning a descriptor we have queued for reuse
        mac80211: correct behaviour on unrecognised action frames
        ath9k: enable serialize_regmode for non-PCIE AR9287
        rtlwifi: rtl8192cu: New USB IDs
        NFC: Return from rawsock_release when sk is NULL
        iwlwifi: fix activating inactive stations
        wlcore: drop INET dependency
        ath9k: fix dynamic WEP related regression
        NFC: Prevent multiple buffer overflows in NCI
        netfilter: update location of my trees
        ...
      56728748