1. 26 8月, 2017 13 次提交
    • E
      tcp: fix hang in tcp_sendpage_locked() · bd9dfc54
      Eric Dumazet 提交于
      syszkaller got a hang in tcp stack, related to a bug in
      tcp_sendpage_locked()
      
      root@syzkaller:~# cat /proc/3059/stack
      [<ffffffff83de926c>] __lock_sock+0x1dc/0x2f0
      [<ffffffff83de9473>] lock_sock_nested+0xf3/0x110
      [<ffffffff8408ce01>] tcp_sendmsg+0x21/0x50
      [<ffffffff84163b6f>] inet_sendmsg+0x11f/0x5e0
      [<ffffffff83dd8eea>] sock_sendmsg+0xca/0x110
      [<ffffffff83dd9547>] kernel_sendmsg+0x47/0x60
      [<ffffffff83de35dc>] sock_no_sendpage+0x1cc/0x280
      [<ffffffff8408916b>] tcp_sendpage_locked+0x10b/0x160
      [<ffffffff84089203>] tcp_sendpage+0x43/0x60
      [<ffffffff841641da>] inet_sendpage+0x1aa/0x660
      [<ffffffff83dd4fcd>] kernel_sendpage+0x8d/0xe0
      [<ffffffff83dd50ac>] sock_sendpage+0x8c/0xc0
      [<ffffffff81b63300>] pipe_to_sendpage+0x290/0x3b0
      [<ffffffff81b67243>] __splice_from_pipe+0x343/0x750
      [<ffffffff81b6a459>] splice_from_pipe+0x1e9/0x330
      [<ffffffff81b6a5e0>] generic_splice_sendpage+0x40/0x50
      [<ffffffff81b6b1d7>] SyS_splice+0x7b7/0x1610
      [<ffffffff84d77a01>] entry_SYSCALL_64_fastpath+0x1f/0xbe
      
      Fixes: 306b13eb ("proto_ops: Add locked held versions of sendmsg and sendpage")
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Reported-by: NDmitry Vyukov <dvyukov@google.com>
      Cc: Tom Herbert <tom@quantonium.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bd9dfc54
    • D
      Merge branch 'net_sched-clean-up-tc-classes-and-u32-filter' · 86df4d2e
      David S. Miller 提交于
      Cong Wang says:
      
      ====================
      net_sched: clean up tc classes and u32 filter
      
      Patch 1 and patch 2 prepare for patch 3. Major changes
      are in patch 3 and patch 4, details are there too.
      
      v2: Add patch 1 and 2, group all into a patchset
          Fix a coding style issue in patch 4
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      86df4d2e
    • W
      net_sched: kill u32_node pointer in Qdisc · 3cd904ec
      WANG Cong 提交于
      It is ugly to hide a u32-filter-specific pointer inside Qdisc,
      this breaks the TC layers:
      
      1. Qdisc is a generic representation, should not have any specific
         data of any type
      
      2. Qdisc layer is above filter layer, should only save filters in
         the list of struct tcf_proto.
      
      This pointer is used as the head of the chain of u32 hash tables,
      that is struct tc_u_hnode, because u32 filter is very special,
      it allows to create multiple hash tables within one qdisc and
      across multiple u32 filters.
      
      Instead of using this ugly pointer, we can just save it in a global
      hash table key'ed by (dev ifindex, qdisc handle), therefore we can
      still treat it as a per qdisc basis data structure conceptually.
      
      Of course, because of network namespaces, this key is not unique
      at all, but it is fine as we already have a pointer to Qdisc in
      struct tc_u_common, we can just compare the pointers when collision.
      
      And this only affects slow paths, has no impact to fast path,
      thanks to the pointer ->tp_c.
      
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Acked-by: NJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3cd904ec
    • W
      net_sched: remove tc class reference counting · 143976ce
      WANG Cong 提交于
      For TC classes, their ->get() and ->put() are always paired, and the
      reference counting is completely useless, because:
      
      1) For class modification and dumping paths, we already hold RTNL lock,
         so all of these ->get(),->change(),->put() are atomic.
      
      2) For filter bindiing/unbinding, we use other reference counter than
         this one, and they should have RTNL lock too.
      
      3) For ->qlen_notify(), it is special because it is called on ->enqueue()
         path, but we already hold qdisc tree lock there, and we hold this
         tree lock when graft or delete the class too, so it should not be gone
         or changed until we release the tree lock.
      
      Therefore, this patch removes ->get() and ->put(), but:
      
      1) Adds a new ->find() to find the pointer to a class by classid, no
         refcnt.
      
      2) Move the original class destroy upon the last refcnt into ->delete(),
         right after releasing tree lock. This is fine because the class is
         already removed from hash when holding the lock.
      
      For those who also use ->put() as ->unbind(), just rename them to reflect
      this change.
      
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Acked-by: NJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      143976ce
    • W
      net_sched: introduce tclass_del_notify() · 14546ba1
      WANG Cong 提交于
      Like for TC actions, ->delete() is a special case,
      we have to prepare and fill the notification before delete
      otherwise would get use-after-free after we remove the
      reference count.
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: NJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      14546ba1
    • W
      net_sched: get rid of more forward declarations · 27d7f07c
      WANG Cong 提交于
      This is not needed if we move them up properly.
      Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: NJiri Pirko <jiri@mellanox.com>
      Acked-by: NJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      27d7f07c
    • D
      hinic: skb_pad() frees on error · 7d8697af
      Dan Carpenter 提交于
      The skb_pad() function frees the skb on error, so this code has a double
      free.
      
      Fixes: 00e57a6d ("net-next/hinic: Add Tx operation")
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7d8697af
    • D
      Merge branch 'ipv6-sr-updates' · cf4828d1
      David S. Miller 提交于
      David Lebrun says:
      
      ====================
      net: updates for IPv6 Segment Routing
      
      v2: seg6_lwt_headroom() is not relevant for lwtunnel_input_redirect()
          use cases, and L2ENCAP only uses this redirection. Fix incoherence
          between arbitrary MAC header size support and fixed headroom
          computation by setting only LWTUNNEL_STATE_INPUT_REDIRECT for L2ENCAP
          mode.
      
      This patch series provides several updates for the SRv6 implementation. The
      first patch leverages the existing infrastructure to support encapsulation
      of IPv4 packets. The second patch implements the T.Encaps.L2 SR function,
      enabling to encapsulate an L2 Ethernet frame within an IPv6+SRH packet.
      The last three patches update the seg6local lightweight tunnel, and mainly
      implement four new actions: End.T, End.DX2, End.DX4 and End.DT6.
      ====================
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      cf4828d1
    • D
      ipv6: sr: implement additional seg6local actions · 891ef8dd
      David Lebrun 提交于
      This patch implements the following seg6local actions.
      
      - SEG6_LOCAL_ACTION_END_T: regular SRH processing and forward to the
        next-hop looked up in the specified routing table.
      
      - SEG6_LOCAL_ACTION_END_DX2: decapsulate an L2 frame and forward it to
        the specified network interface.
      
      - SEG6_LOCAL_ACTION_END_DX4: decapsulate an IPv4 packet and forward it,
        possibly to the specified next-hop.
      
      - SEG6_LOCAL_ACTION_END_DT6: decapsulate an IPv6 packet and forward it
        to the next-hop looked up in the specified routing table.
      Signed-off-by: NDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      891ef8dd
    • D
      ipv6: sr: add helper functions for seg6local · d7a669dd
      David Lebrun 提交于
      This patch adds three helper functions to be used with the seg6local packet
      processing actions.
      
      The decap_and_validate() function will be used by the End.D* actions, that
      decapsulate an SR-enabled packet.
      
      The advance_nextseg() function applies the fundamental operations to update
      an SRH for the next segment.
      
      The lookup_nexthop() function helps select the next-hop for the processed
      SR packets. It supports an optional next-hop address to route the packet
      specifically through it, and an optional routing table to use.
      Signed-off-by: NDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d7a669dd
    • D
      ipv6: sr: enforce IPv6 packets for seg6local lwt · 6285217f
      David Lebrun 提交于
      This patch ensures that the seg6local lightweight tunnel is used solely
      with IPv6 routes and processes only IPv6 packets.
      Signed-off-by: NDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6285217f
    • D
      ipv6: sr: add support for encapsulation of L2 frames · 38ee7f2d
      David Lebrun 提交于
      This patch implements the L2 frame encapsulation mechanism, referred to
      as T.Encaps.L2 in the SRv6 specifications [1].
      
      A new type of SRv6 tunnel mode is added (SEG6_IPTUN_MODE_L2ENCAP). It only
      accepts packets with an existing MAC header (i.e., it will not work for
      locally generated packets). The resulting packet looks like IPv6 -> SRH ->
      Ethernet -> original L3 payload. The next header field of the SRH is set to
      NEXTHDR_NONE.
      
      [1] https://tools.ietf.org/html/draft-filsfils-spring-srv6-network-programming-01Signed-off-by: NDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      38ee7f2d
    • D
      ipv6: sr: add support for ip4ip6 encapsulation · 32d99d0b
      David Lebrun 提交于
      This patch enables the SRv6 encapsulation mode to carry an IPv4 payload.
      All the infrastructure was already present, I just had to add a parameter
      to seg6_do_srh_encap() to specify the inner packet protocol, and perform
      some additional checks.
      
      Usage example:
      ip route add 1.2.3.4 encap seg6 mode encap segs fc00::1,fc00::2 dev eth0
      Signed-off-by: NDavid Lebrun <david.lebrun@uclouvain.be>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      32d99d0b
  2. 25 8月, 2017 27 次提交