1. 23 10月, 2016 7 次提交
  2. 21 10月, 2016 2 次提交
    • F
      net: dsa: bcm_sf2: Prevent GPHY shutdown for kexec'd kernels · 2399d614
      Florian Fainelli 提交于
      For a kernel that is being kexec'd we re-enable the integrated GPHY in
      order for the subsequent MDIO bus scan to succeed and properly bind to
      the bcm7xxx PHY driver. If we did not do that, the GPHY would be shut
      down by the time the MDIO driver is probing the bus, and it would fail
      to read the correct PHY OUI and therefore bind to an appropriate PHY
      driver. Later on, this would cause DSA not to be able to successfully
      attach to the PHY, and the interface would not be created at all.
      Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2399d614
    • S
      net: add recursion limit to GRO · fcd91dd4
      Sabrina Dubroca 提交于
      Currently, GRO can do unlimited recursion through the gro_receive
      handlers.  This was fixed for tunneling protocols by limiting tunnel GRO
      to one level with encap_mark, but both VLAN and TEB still have this
      problem.  Thus, the kernel is vulnerable to a stack overflow, if we
      receive a packet composed entirely of VLAN headers.
      
      This patch adds a recursion counter to the GRO layer to prevent stack
      overflow.  When a gro_receive function hits the recursion limit, GRO is
      aborted for this skb and it is processed normally.  This recursion
      counter is put in the GRO CB, but could be turned into a percpu counter
      if we run out of space in the CB.
      
      Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report.
      
      Fixes: CVE-2016-7039
      Fixes: 9b174d88 ("net: Add Transparent Ethernet Bridging GRO support.")
      Fixes: 66e5133f ("vlan: Add GRO support for non hardware accelerated vlan")
      Signed-off-by: NSabrina Dubroca <sd@queasysnail.net>
      Reviewed-by: NJiri Benc <jbenc@redhat.com>
      Acked-by: NHannes Frederic Sowa <hannes@stressinduktion.org>
      Acked-by: NTom Herbert <tom@herbertland.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fcd91dd4
  3. 20 10月, 2016 6 次提交
  4. 19 10月, 2016 7 次提交
  5. 18 10月, 2016 11 次提交
  6. 17 10月, 2016 2 次提交
    • C
      cxgb4: fix memory leak of qe on error exit path · 67b11e2e
      Colin Ian King 提交于
      A memory leak of qe occurs when t4_sched_queue_unbind fails,
      so fix this by free'ing qe on the error exit path.
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      67b11e2e
    • D
      net: Require exact match for TCP socket lookups if dif is l3mdev · a04a480d
      David Ahern 提交于
      Currently, socket lookups for l3mdev (vrf) use cases can match a socket
      that is bound to a port but not a device (ie., a global socket). If the
      sysctl tcp_l3mdev_accept is not set this leads to ack packets going out
      based on the main table even though the packet came in from an L3 domain.
      The end result is that the connection does not establish creating
      confusion for users since the service is running and a socket shows in
      ss output. Fix by requiring an exact dif to sk_bound_dev_if match if the
      skb came through an interface enslaved to an l3mdev device and the
      tcp_l3mdev_accept is not set.
      
      skb's through an l3mdev interface are marked by setting a flag in
      inet{6}_skb_parm. The IPv6 variant is already set; this patch adds the
      flag for IPv4. Using an skb flag avoids a device lookup on the dif. The
      flag is set in the VRF driver using the IP{6}CB macros. For IPv4, the
      inet_skb_parm struct is moved in the cb per commit 971f10ec, so the
      match function in the TCP stack needs to use TCP_SKB_CB. For IPv6, the
      move is done after the socket lookup, so IP6CB is used.
      
      The flags field in inet_skb_parm struct needs to be increased to add
      another flag. There is currently a 1-byte hole following the flags,
      so it can be expanded to u16 without increasing the size of the struct.
      
      Fixes: 193125db ("net: Introduce VRF device driver")
      Signed-off-by: NDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      a04a480d
  7. 16 10月, 2016 4 次提交
  8. 15 10月, 2016 1 次提交
    • G
      net: asix: Avoid looping when the device does not respond · 610df1d2
      Guenter Roeck 提交于
      Check answers from USB stack and avoid re-sending the request
      multiple times if the device does not respond.
      
      This fixes the following problem, observed with a probably flaky adapter.
      
      [62108.732707] usb 1-3: new high-speed USB device number 5 using xhci_hcd
      [62108.914421] usb 1-3: New USB device found, idVendor=0b95, idProduct=7720
      [62108.914463] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
      [62108.914476] usb 1-3: Product: AX88x72A
      [62108.914486] usb 1-3: Manufacturer: ASIX Elec. Corp.
      [62108.914495] usb 1-3: SerialNumber: 000001
      [62114.109109] asix 1-3:1.0 (unnamed net_device) (uninitialized):
      	Failed to write reg index 0x0000: -110
      [62114.109139] asix 1-3:1.0 (unnamed net_device) (uninitialized):
      	Failed to send software reset: ffffff92
      [62119.109048] asix 1-3:1.0 (unnamed net_device) (uninitialized):
      	Failed to write reg index 0x0000: -110
      ...
      
      Since the USB timeout is 5 seconds, and the operation is retried 30 times,
      this results in
      
      [62278.180353] INFO: task mtpd:1725 blocked for more than 120 seconds.
      [62278.180373]       Tainted: G        W      3.18.0-13298-g94ace9e #1
      [62278.180383] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
      ...
      [62278.180957] kworker/2:0     D 0000000000000000     0  5744      2 0x00000000
      [62278.180978] Workqueue: usb_hub_wq hub_event
      [62278.181029]  ffff880177f833b8 0000000000000046 ffff88017fd00000 ffff88017b126d80
      [62278.181048]  ffff880177f83fd8 ffff880065a71b60 0000000000013340 ffff880065a71b60
      [62278.181065]  0000000000000286 0000000103b1c199 0000000000001388 0000000000000002
      [62278.181081] Call Trace:
      [62278.181092]  [<ffffffff8e0971fd>] ? console_conditional_schedule+0x2c/0x2c
      [62278.181105]  [<ffffffff8e094f7b>] schedule+0x69/0x6b
      [62278.181117]  [<ffffffff8e0972e0>] schedule_timeout+0xe3/0x11d
      [62278.181133]  [<ffffffff8daadb1b>] ? trace_timer_start+0x51/0x51
      [62278.181146]  [<ffffffff8e095a05>] do_wait_for_common+0x12f/0x16c
      [62278.181162]  [<ffffffff8da856a7>] ? wake_up_process+0x39/0x39
      [62278.181174]  [<ffffffff8e095aee>] wait_for_common+0x52/0x6d
      [62278.181187]  [<ffffffff8e095b3b>] wait_for_completion_timeout+0x13/0x15
      [62278.181201]  [<ffffffff8de676ce>] usb_start_wait_urb+0x93/0xf1
      [62278.181214]  [<ffffffff8de6780d>] usb_control_msg+0xe1/0x11d
      [62278.181230]  [<ffffffffc037d629>] usbnet_write_cmd+0x9c/0xc6 [usbnet]
      [62278.181286]  [<ffffffffc03af793>] asix_write_cmd+0x4e/0x7e [asix]
      [62278.181300]  [<ffffffffc03afb41>] asix_set_sw_mii+0x25/0x4e [asix]
      [62278.181314]  [<ffffffffc03b001d>] asix_mdio_read+0x51/0x109 [asix]
      ...
      Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      610df1d2