1. 29 9月, 2018 11 次提交
  2. 27 9月, 2018 5 次提交
  3. 26 9月, 2018 13 次提交
  4. 25 9月, 2018 5 次提交
  5. 24 9月, 2018 6 次提交
    • F
      net: aquantia: memory corruption on jumbo frames · d26ed6b0
      Friedemann Gerold 提交于
      This patch fixes skb_shared area, which will be corrupted
      upon reception of 4K jumbo packets.
      
      Originally build_skb usage purpose was to reuse page for skb to eliminate
      needs of extra fragments. But that logic does not take into account that
      skb_shared_info should be reserved at the end of skb data area.
      
      In case packet data consumes all the page (4K), skb_shinfo location
      overflows the page. As a consequence, __build_skb zeroed shinfo data above
      the allocated page, corrupting next page.
      
      The issue is rarely seen in real life because jumbo are normally larger
      than 4K and that causes another code path to trigger.
      But it 100% reproducible with simple scapy packet, like:
      
          sendp(IP(dst="192.168.100.3") / TCP(dport=443) \
                / Raw(RandString(size=(4096-40))), iface="enp1s0")
      
      Fixes: 018423e9 ("net: ethernet: aquantia: Add ring support code")
      Reported-by: NFriedemann Gerold <f.gerold@b-c-s.de>
      Reported-by: NMichael Rauch <michael@rauch.be>
      Signed-off-by: NFriedemann Gerold <f.gerold@b-c-s.de>
      Tested-by: NNikita Danilov <nikita.danilov@aquantia.com>
      Signed-off-by: NIgor Russkikh <igor.russkikh@aquantia.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d26ed6b0
    • E
      nfp: remove ndo_poll_controller · 0825ce70
      Eric Dumazet 提交于
      As diagnosed by Song Liu, ndo_poll_controller() can
      be very dangerous on loaded hosts, since the cpu
      calling ndo_poll_controller() might steal all NAPI
      contexts (for all RX/TX queues of the NIC). This capture
      can last for unlimited amount of time, since one
      cpu is generally not able to drain all the queues under load.
      
      nfp uses NAPI for TX completions, so we better let core
      networking stack call the napi->poll() to avoid the capture.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Jakub Kicinski <jakub.kicinski@netronome.com>
      Acked-by: NJakub Kicinski <jakub.kicinski@netronome.com>
      Tested-by: NJakub Kicinski <jakub.kicinski@netronome.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0825ce70
    • E
      bnxt: remove ndo_poll_controller · 58e0e22b
      Eric Dumazet 提交于
      As diagnosed by Song Liu, ndo_poll_controller() can
      be very dangerous on loaded hosts, since the cpu
      calling ndo_poll_controller() might steal all NAPI
      contexts (for all RX/TX queues of the NIC). This capture
      can last for unlimited amount of time, since one
      cpu is generally not able to drain all the queues under load.
      
      bnxt uses NAPI for TX completions, so we better let core
      networking stack call the napi->poll() to avoid the capture.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Michael Chan <michael.chan@broadcom.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      58e0e22b
    • E
      bnx2x: remove ndo_poll_controller · d8ea6a91
      Eric Dumazet 提交于
      As diagnosed by Song Liu, ndo_poll_controller() can
      be very dangerous on loaded hosts, since the cpu
      calling ndo_poll_controller() might steal all NAPI
      contexts (for all RX/TX queues of the NIC). This capture
      can last for unlimited amount of time, since one
      cpu is generally not able to drain all the queues under load.
      
      bnx2x uses NAPI for TX completions, so we better let core
      networking stack call the napi->poll() to avoid the capture.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Ariel Elior <ariel.elior@cavium.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d8ea6a91
    • E
      mlx5: remove ndo_poll_controller · 9c29bcd1
      Eric Dumazet 提交于
      As diagnosed by Song Liu, ndo_poll_controller() can
      be very dangerous on loaded hosts, since the cpu
      calling ndo_poll_controller() might steal all NAPI
      contexts (for all RX/TX queues of the NIC). This capture
      can last for unlimited amount of time, since one
      cpu is generally not able to drain all the queues under load.
      
      mlx5 uses NAPI for TX completions, so we better let core
      networking stack call the napi->poll() to avoid the capture.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Saeed Mahameed <saeedm@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9c29bcd1
    • E
      mlx4: remove ndo_poll_controller · a24b66c2
      Eric Dumazet 提交于
      As diagnosed by Song Liu, ndo_poll_controller() can
      be very dangerous on loaded hosts, since the cpu
      calling ndo_poll_controller() might steal all NAPI
      contexts (for all RX/TX queues of the NIC). This capture
      can last for unlimited amount of time, since one
      cpu is generally not able to drain all the queues under load.
      
      mlx4 uses NAPI for TX completions, so we better let core
      networking stack call the napi->poll() to avoid the capture.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Tariq Toukan <tariqt@mellanox.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a24b66c2