Skip to content
  1. May 17, 2016
    • Vitaly Kuznetsov's avatar
      hv_netvsc: untangle the pointer mess · 3d541ac5
      Vitaly Kuznetsov authored
      
      
      We have the following structures keeping netvsc adapter state:
      - struct net_device
      - struct net_device_context
      - struct netvsc_device
      - struct rndis_device
      - struct hv_device
      and there are pointers/dependencies between them:
      - struct net_device_context is contained in struct net_device
      - struct hv_device has driver_data pointer which points to
        'struct net_device' OR 'struct netvsc_device' depending on driver's
        state (!).
      - struct net_device_context has a pointer to 'struct hv_device'.
      - struct netvsc_device has pointers to 'struct hv_device' and
        'struct net_device_context'.
      - struct rndis_device has a pointer to 'struct netvsc_device'.
      
      Different functions get different structures as parameters and use these
      pointers for traveling. The problem is (in addition to keeping in mind
      this complex graph) that some of these structures (struct netvsc_device
      and struct rndis_device) are being removed and re-created on mtu change
      (as we implement it as re-creation of hyper-v device) so our travel using
      these pointers is dangerous.
      
      Simplify this to a the following:
      - add struct netvsc_device pointer to struct net_device_context (which is
        a part of struct net_device and thus never disappears)
      - remove struct hv_device and struct net_device_context pointers from
        struct netvsc_device
      - replace pointer to 'struct netvsc_device' with pointer to
        'struct net_device'.
      - always keep 'struct net_device' in hv_device driver_data.
      
      We'll end up with the following 'circular' structure:
      
      net_device:
       [net_device_context] -> netvsc_device -> rndis_device -> net_device
                            -> hv_device -> net_device
      
      On MTU change we'll be removing the 'netvsc_device -> rndis_device'
      branch and re-creating it making the synchronization easier.
      
      There is one additional redundant pointer left, it is struct net_device
      link in struct netvsc_device, it is going to be removed in a separate
      commit.
      
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3d541ac5
    • Vitaly Kuznetsov's avatar
      hv_netvsc: use start_remove flag to protect netvsc_link_change() · 1bdcec8a
      Vitaly Kuznetsov authored
      
      
      netvsc_link_change() can race with netvsc_change_mtu() or
      netvsc_set_channels() as these functions destroy struct netvsc_device and
      rndis filter. Use start_remove flag for syncronization. As
      netvsc_change_mtu()/netvsc_set_channels() are called with rtnl lock held
      we need to take it before checking start_remove value in
      netvsc_link_change().
      
      Reported-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1bdcec8a
    • Vitaly Kuznetsov's avatar
      hv_netvsc: move start_remove flag to net_device_context · f580aec4
      Vitaly Kuznetsov authored
      
      
      struct netvsc_device is destroyed on mtu change so keeping the
      protection flag there is not a good idea. Move it to struct
      net_device_context which is preserved.
      
      Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f580aec4
    • Uwe Kleine-König's avatar
      phy: add support for a reset-gpio specification · da47b457
      Uwe Kleine-König authored
      
      
      The framework only asserts (for now) that the reset gpio is not active.
      
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarRoger Quadros <rogerq@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      da47b457
  2. May 16, 2016
  3. May 15, 2016
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 272911b8
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix mvneta/bm dependencies, from Arnd Bergmann.
      
       2) RX completion hw bug workaround in bnxt_en, from Michael Chan.
      
       3) Kernel pointer leak in nf_conntrack, from Linus.
      
       4) Hoplimit route attribute limits not enforced properly, from Paolo
          Abeni.
      
       5) qlcnic driver NULL deref fix from Dan Carpenter.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        arm64: bpf: jit JMP_JSET_{X,K}
        net/route: enforce hoplimit max value
        nf_conntrack: avoid kernel pointer value leak in slab name
        drivers: net: xgene: fix register offset
        drivers: net: xgene: fix statistics counters race condition
        drivers: net: xgene: fix ununiform latency across queues
        drivers: net: xgene: fix sharing of irqs
        drivers: net: xgene: fix IPv4 forward crash
        xen-netback: fix extra_info handling in xenvif_tx_err()
        net: mvneta: bm: fix dependencies again
        bnxt_en: Add workaround to detect bad opaque in rx completion (part 2)
        bnxt_en: Add workaround to detect bad opaque in rx completion (part 1)
        qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()
      272911b8
    • Florian Fainelli's avatar
      net: switchdev: Drop EXPERIMENTAL from description · 8fbb89c6
      Florian Fainelli authored
      
      
      Switchdev has been around for quite a while now, putting "EXPERIMENTAL"
      in the description is no longer accurate, drop it.
      
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8fbb89c6
    • Zi Shen Lim's avatar
      arm64: bpf: jit JMP_JSET_{X,K} · 98397fc5
      Zi Shen Lim authored
      
      
      Original implementation commit e54bcde3 ("arm64: eBPF JIT compiler")
      had the relevant code paths, but due to an oversight always fail jiting.
      
      As a result, we had been falling back to BPF interpreter whenever a BPF
      program has JMP_JSET_{X,K} instructions.
      
      With this fix, we confirm that the corresponding tests in lib/test_bpf
      continue to pass, and also jited.
      
      ...
      [    2.784553] test_bpf: #30 JSET jited:1 188 192 197 PASS
      [    2.791373] test_bpf: #31 tcpdump port 22 jited:1 325 677 625 PASS
      [    2.808800] test_bpf: #32 tcpdump complex jited:1 323 731 991 PASS
      ...
      [    3.190759] test_bpf: #237 JMP_JSET_K: if (0x3 & 0x2) return 1 jited:1 110 PASS
      [    3.192524] test_bpf: #238 JMP_JSET_K: if (0x3 & 0xffffffff) return 1 jited:1 98 PASS
      [    3.211014] test_bpf: #249 JMP_JSET_X: if (0x3 & 0x2) return 1 jited:1 120 PASS
      [    3.212973] test_bpf: #250 JMP_JSET_X: if (0x3 & 0xffffffff) return 1 jited:1 89 PASS
      ...
      
      Fixes: e54bcde3 ("arm64: eBPF JIT compiler")
      Signed-off-by: default avatarZi Shen Lim <zlim.lnx@gmail.com>
      Acked-by: default avatarWill Deacon <will.deacon@arm.com>
      Acked-by: default avatarYang Shi <yang.shi@linaro.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      98397fc5
    • Paolo Abeni's avatar
      net/route: enforce hoplimit max value · 626abd59
      Paolo Abeni authored
      
      
      Currently, when creating or updating a route, no check is performed
      in both ipv4 and ipv6 code to the hoplimit value.
      
      The caller can i.e. set hoplimit to 256, and when such route will
       be used, packets will be sent with hoplimit/ttl equal to 0.
      
      This commit adds checks for the RTAX_HOPLIMIT value, in both ipv4
      ipv6 route code, substituting any value greater than 255 with 255.
      
      This is consistent with what is currently done for ADVMSS and MTU
      in the ipv4 code.
      
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      626abd59
    • Linus Torvalds's avatar
      nf_conntrack: avoid kernel pointer value leak in slab name · 31b0b385
      Linus Torvalds authored
      
      
      The slab name ends up being visible in the directory structure under
      /sys, and even if you don't have access rights to the file you can see
      the filenames.
      
      Just use a 64-bit counter instead of the pointer to the 'net' structure
      to generate a unique name.
      
      This code will go away in 4.7 when the conntrack code moves to a single
      kmemcache, but this is the backportable simple solution to avoiding
      leaking kernel pointers to user space.
      
      Fixes: 5b3501faa874 ("netfilter: nf_conntrack: per netns nf_conntrack_cachep")
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Acked-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      31b0b385
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 6ba5b85f
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Overlayfs fixes from Miklos, assorted fixes from me.
      
        Stable fodder of varying severity, all sat in -next for a while"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        ovl: ignore permissions on underlying lookup
        vfs: add lookup_hash() helper
        vfs: rename: check backing inode being equal
        vfs: add vfs_select_inode() helper
        get_rock_ridge_filename(): handle malformed NM entries
        ecryptfs: fix handling of directory opening
        atomic_open(): fix the handling of create_error
        fix the copy vs. map logics in blk_rq_map_user_iov()
        do_splice_to(): cap the size before passing to ->splice_read()
      6ba5b85f
  4. May 14, 2016