linux-stable.git/drivers/net/vxlan.c, branch linux-3.13.y

net: vxlan: fix crash when interface is created with no group

2014-04-14T13:47:22+00:00

[ Upstream commit 5933a7bbb5de66482ea8aa874a7ebaf8e67603c4 ]

If the vxlan interface is created without explicit group definition,
there are corner cases which may cause kernel panic.

For instance, in the following scenario:

node A:
$ ip link add dev vxlan42  address 2c:c2:60:00:10:20 type vxlan id 42
$ ip addr add dev vxlan42 10.0.0.1/24
$ ip link set up dev vxlan42
$ arp -i vxlan42 -s 10.0.0.2 2c:c2:60:00:01:02
$ bridge fdb add dev vxlan42 to 2c:c2:60:00:01:02 dst 
$ ping 10.0.0.2

node B:
$ ip link add dev vxlan42 address 2c:c2:60:00:01:02 type vxlan id 42
$ ip addr add dev vxlan42 10.0.0.2/24
$ ip link set up dev vxlan42
$ arp -i vxlan42 -s 10.0.0.1 2c:c2:60:00:10:20

node B crashes:

 vxlan42: 2c:c2:60:00:10:20 migrated from 4011:eca4:c0a8:6466:c0a8:6415:8e09:2118 to (invalid address)
 vxlan42: 2c:c2:60:00:10:20 migrated from 4011:eca4:c0a8:6466:c0a8:6415:8e09:2118 to (invalid address)
 BUG: unable to handle kernel NULL pointer dereference at 0000000000000046
 IP: [] ip6_route_output+0x58/0x82
 PGD 7bd89067 PUD 7bd4e067 PMD 0
 Oops: 0000 [#1] SMP
 Modules linked in:
 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.14.0-rc8-hvx-xen-00019-g97a5221-dirty #154
 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 task: ffff88007c774f50 ti: ffff88007c79c000 task.ti: ffff88007c79c000
 RIP: 0010:[]  [] ip6_route_output+0x58/0x82
 RSP: 0018:ffff88007fd03668  EFLAGS: 00010282
 RAX: 0000000000000000 RBX: ffffffff8186a000 RCX: 0000000000000040
 RDX: 0000000000000000 RSI: ffff88007b0e4a80 RDI: ffff88007fd03754
 RBP: ffff88007fd03688 R08: ffff88007b0e4a80 R09: 0000000000000000
 R10: 0200000a0100000a R11: 0001002200000000 R12: ffff88007fd03740
 R13: ffff88007b0e4a80 R14: ffff88007b0e4a80 R15: ffff88007bba0c50
 FS:  0000000000000000(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000046 CR3: 000000007bb60000 CR4: 00000000000006e0
 Stack:
  0000000000000000 ffff88007fd037a0 ffffffff8186a000 ffff88007fd03740
  ffff88007fd036c8 ffffffff814320bb 0000000000006e49 ffff88007b8b7360
  ffff88007bdbf200 ffff88007bcbc000 ffff88007b8b7000 ffff88007b8b7360
 Call Trace:
  
  [] ip6_dst_lookup_tail+0x2d/0xa4
  [] ip6_dst_lookup+0x10/0x12
  [] vxlan_xmit_one+0x32a/0x68c
  [] ? _raw_spin_unlock_irqrestore+0x12/0x14
  [] ? lock_timer_base.isra.23+0x26/0x4b
  [] vxlan_xmit+0x66a/0x6a8
  [] ? ipt_do_table+0x35f/0x37e
  [] ? selinux_ip_postroute+0x41/0x26e
  [] dev_hard_start_xmit+0x2ce/0x3ce
  [] __dev_queue_xmit+0x2d0/0x392
  [] ? eth_header+0x28/0xb5
  [] dev_queue_xmit+0xb/0xd
  [] neigh_resolve_output+0x134/0x152
  [] ip_finish_output2+0x236/0x299
  [] ip_finish_output+0x98/0x9d
  [] ip_output+0x62/0x67
  [] dst_output+0xf/0x11
  [] ip_local_out+0x1b/0x1f
  [] ip_send_skb+0x11/0x37
  [] ip_push_pending_frames+0x2f/0x33
  [] icmp_push_reply+0x106/0x115
  [] icmp_reply+0x142/0x164
  [] icmp_echo.part.16+0x46/0x48
  [] ? nf_iterate+0x43/0x80
  [] ? xfrm4_policy_check.constprop.11+0x52/0x52
  [] icmp_echo+0x25/0x27
  [] icmp_rcv+0x1d2/0x20a
  [] ? xfrm4_policy_check.constprop.11+0x52/0x52
  [] ip_local_deliver_finish+0xd6/0x14f
  [] ? xfrm4_policy_check.constprop.11+0x52/0x52
  [] NF_HOOK.constprop.10+0x4c/0x53
  [] ip_local_deliver+0x4a/0x4f
  [] ip_rcv_finish+0x253/0x26a
  [] ? inet_add_protocol+0x3e/0x3e
  [] NF_HOOK.constprop.10+0x4c/0x53
  [] ip_rcv+0x2a6/0x2ec
  [] __netif_receive_skb_core+0x43e/0x478
  [] ? virtqueue_poll+0x16/0x27
  [] __netif_receive_skb+0x55/0x5a
  [] process_backlog+0x76/0x12f
  [] net_rx_action+0xa2/0x1ab
  [] __do_softirq+0xca/0x1d1
  [] irq_exit+0x3e/0x85
  [] do_IRQ+0xa9/0xc4
  [] common_interrupt+0x6d/0x6d
  
  [] ? native_safe_halt+0x6/0x8
  [] default_idle+0x9/0xd
  [] arch_cpu_idle+0x13/0x1c
  [] cpu_startup_entry+0xbc/0x137
  [] start_secondary+0x1a0/0x1a5
 Code: 24 14 e8 f1 e5 01 00 31 d2 a8 32 0f 95 c2 49 8b 44 24 2c 49 0b 44 24 24 74 05 83 ca 04 eb 1c 4d 85 ed 74 17 49 8b 85 a8 02 00 00 <66> 8b 40 46 66 c1 e8 07 83 e0 07 c1 e0 03 09 c2 4c 89 e6 48 89
 RIP  [] ip6_route_output+0x58/0x82
  RSP 
 CR2: 0000000000000046
 ---[ end trace 4612329caab37efd ]---

When vxlan interface is created without explicit group definition, the
default_dst protocol family is initialiazed to AF_UNSPEC and the driver
assumes IPv4 configuration. On the other side, the default_dst protocol
family is used to differentiate between IPv4 and IPv6 cases and, since,
AF_UNSPEC != AF_INET, the processing takes the IPv6 path.

Making the IPv4 assumption explicit by settting default_dst protocol
family to AF_INET4 and preventing mixing of IPv4 and IPv6 addresses in
snooped fdb entries fixes the corner case crashes.

Signed-off-by: Mike Rapoport 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

vxlan: fix nonfunctional neigh_reduce()

2014-04-14T13:47:20+00:00

[ Upstream commit 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa ]

The VXLAN neigh_reduce() code is completely non-functional since
check-in. Specific errors:

1) The original code drops all packets with a multicast destination address,
	even though neighbor solicitations are sent to the solicited-node
	address, a multicast address. The code after this check was never run.
2) The neighbor table lookup used the IPv6 header destination, which is the
	solicited node address, rather than the target address from the
	neighbor solicitation. So neighbor lookups would always fail if it
	got this far. Also for L3MISSes.
3) The code calls ndisc_send_na(), which does a send on the tunnel device.
	The context for neigh_reduce() is the transmit path, vxlan_xmit(),
	where the host or a bridge-attached neighbor is trying to transmit
	a neighbor solicitation. To respond to it, the tunnel endpoint needs
	to do a *receive* of the appropriate neighbor advertisement. Doing a
	send, would only try to send the advertisement, encapsulated, to the
	remote destinations in the fdb -- hosts that definitely did not do the
	corresponding solicitation.
4) The code uses the tunnel endpoint IPv6 forwarding flag to determine the
	isrouter flag in the advertisement. This has nothing to do with whether
	or not the target is a router, and generally won't be set since the
	tunnel endpoint is bridging, not routing, traffic.

	The patch below creates a proxy neighbor advertisement to respond to
neighbor solicitions as intended, providing proper IPv6 support for neighbor
reduction.

Signed-off-by: David L Stevens 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

vxlan: fix potential NULL dereference in arp_reduce()

2014-04-14T13:47:20+00:00

[ Upstream commit 7346135dcd3f9b57f30a5512094848c678d7143e ]

This patch fixes a NULL pointer dereference in the event of an
skb allocation failure in arp_reduce().

Signed-Off-By: David L Stevens 
Acked-by: Cong Wang 

Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net/vxlan: Share RX skb de-marking and checksum checks with ovs

2014-02-06T19:34:07+00:00

[ Upstream commit d0bc65557ad09a57b4db176e9e3ccddb26971453 ]

Make sure the practice set by commit 0afb166 "vxlan: Add capability
of Rx checksum offload for inner packet" is applied when the skb
goes through the portion of the RX code which is shared between
vxlan netdevices and ovs vxlan port instances.

Cc: Joseph Gasparakis 
Cc: Pravin B Shelar 
Signed-off-by: Or Gerlitz 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

{vxlan, inet6} Mark vxlan_dev flags with VXLAN_F_IPV6 properly

2014-01-04T01:36:00+00:00

Even if user doesn't supply the physical netdev to attach vxlan dev
to, and at the same time user want to vxlan sit top of IPv6, mark
vxlan_dev flags with VXLAN_F_IPV6 to create IPv6 based socket.
Otherwise kernel crashes safely every time spitting below messages,

Steps to reproduce:
ip link add vxlan0 type vxlan id 42 group ff0e::110
ip link set vxlan0 up

[   62.656266] BUG: unable to handle kernel NULL pointer dereference[   62.656320] ip (3008) used greatest stack depth: 3912 bytes left
 at 0000000000000046
[   62.656423] IP: [] ip6_route_output+0xbd/0xe0
[   62.656525] PGD 2c966067 PUD 2c9a2067 PMD 0
[   62.656674] Oops: 0000 [#1] SMP
[   62.656781] Modules linked in: vxlan netconsole deflate zlib_deflate af_key
[   62.657083] CPU: 1 PID: 2128 Comm: whoopsie Not tainted 3.12.0+ #182
[   62.657083] Hardware name: innotek GmbH VirtualBox, BIOS VirtualBox 12/01/2006
[   62.657083] task: ffff88002e2335d0 ti: ffff88002c94c000 task.ti: ffff88002c94c000
[   62.657083] RIP: 0010:[]  [] ip6_route_output+0xbd/0xe0
[   62.657083] RSP: 0000:ffff88002fd038f8  EFLAGS: 00210296
[   62.657083] RAX: 0000000000000000 RBX: ffff88002fd039e0 RCX: 0000000000000000
[   62.657083] RDX: ffff88002fd0eb68 RSI: ffff88002fd0d278 RDI: ffff88002fd0d278
[   62.657083] RBP: ffff88002fd03918 R08: 0000000002000000 R09: 0000000000000000
[   62.657083] R10: 00000000000001ff R11: 0000000000000000 R12: 0000000000000001
[   62.657083] R13: ffff88002d96b480 R14: ffffffff81c8e2c0 R15: 0000000000000001
[   62.657083] FS:  0000000000000000(0000) GS:ffff88002fd00000(0063) knlGS:00000000f693b740
[   62.657083] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[   62.657083] CR2: 0000000000000046 CR3: 000000002c9d2000 CR4: 00000000000006e0
[   62.657083] Stack:
[   62.657083]  ffff88002fd03a40 ffffffff81c8e2c0 ffff88002fd039e0 ffff88002d96b480
[   62.657083]  ffff88002fd03958 ffffffff816cac8b ffff880019277cc0 ffff8800192b5d00
[   62.657083]  ffff88002d5bc000 ffff880019277cc0 0000000000001821 0000000000000001
[   62.657083] Call Trace:
[   62.657083]  
[   62.657083]  [] ip6_dst_lookup_tail+0xdb/0xf0
[   62.657083]  [] ip6_dst_lookup+0x10/0x20
[   62.657083]  [] vxlan_xmit_one+0x193/0x9c0 [vxlan]
[   62.657083]  [] ? account+0xc7/0x1f0
[   62.657083]  [] vxlan_xmit+0xd3/0x400 [vxlan]
[   62.657083]  [] dev_hard_start_xmit+0x49d/0x5e0
[   62.657083]  [] dev_queue_xmit+0x2d9/0x480
[   62.657083]  [] ? _raw_write_unlock_bh+0x14/0x20
[   62.657083]  [] ? eth_header+0x35/0xe0
[   62.657083]  [] neigh_resolve_output+0x11e/0x1e0
[   62.657083]  [] ? ip6_fragment+0xad0/0xad0
[   62.657083]  [] ip6_finish_output2+0x2f5/0x470
[   62.657083]  [] ip6_finish_output+0x86/0xc0
[   62.657083]  [] ip6_output+0x78/0xb0
[   62.657083]  [] mld_sendpack+0x256/0x2a0
[   62.657083]  [] mld_ifc_timer_expire+0x17c/0x290
[   62.657083]  [] ? igmp6_timer_handler+0x80/0x80
[   62.657083]  [] ? igmp6_timer_handler+0x80/0x80
[   62.657083]  [] call_timer_fn+0x45/0x150
[   62.657083]  [] ? igmp6_timer_handler+0x80/0x80
[   62.657083]  [] run_timer_softirq+0x1f3/0x2a0
[   62.657083]  [] ? lapic_next_event+0x18/0x20
[   62.657083]  [] ? clockevents_program_event+0x6f/0x110
[   62.657083]  [] __do_softirq+0xd6/0x2b0
[   62.657083]  [] irq_exit+0x7e/0xa0
[   62.657083]  [] smp_apic_timer_interrupt+0x45/0x60
[   62.657083]  [] apic_timer_interrupt+0x6a/0x70
[   62.657083]  
[   62.657083]  [] ? sysenter_dispatch+0x7/0x1a
[   62.657083] Code: 4d 8b 85 a8 02 00 00 4c 89 e9 ba 03 04 00 00 48 c7 c6 c0 be 8d 81 48 c7 c7 48 35 a3 81 31 c0 e8 db 68 0e 00 49 8b 85 a8 02 00 00 <0f> b6 40 46 c0 e8 05 0f b6 c0 c1 e0 03 41 09 c4 e9 77 ff ff ff
[   62.657083] RIP  [] ip6_route_output+0xbd/0xe0
[   62.657083]  RSP 
[   62.657083] CR2: 0000000000000046
[   62.657083] ---[ end trace ba8a9583d7cd1934 ]---
[   62.657083] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Fan Du 
Reported-by: Ryan Whelan 
Acked-by: Cong Wang 
Signed-off-by: David S. Miller

vxlan: release rt when found circular route

2013-12-11T03:01:54+00:00

Otherwise causing dst memory leakage.
Have Checked all other type tunnel device transmit implementation,
no such things happens anymore.

Signed-off-by: Fan Du 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2013-11-14T07:30:30+00:00

Pull core locking changes from Ingo Molnar:
 "The biggest changes:

   - add lockdep support for seqcount/seqlocks structures, this
     unearthed both bugs and required extra annotation.

   - move the various kernel locking primitives to the new
     kernel/locking/ directory"

* 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
  block: Use u64_stats_init() to initialize seqcounts
  locking/lockdep: Mark __lockdep_count_forward_deps() as static
  lockdep/proc: Fix lock-time avg computation
  locking/doc: Update references to kernel/mutex.c
  ipv6: Fix possible ipv6 seqlock deadlock
  cpuset: Fix potential deadlock w/ set_mems_allowed
  seqcount: Add lockdep functionality to seqcount/seqlock structures
  net: Explicitly initialize u64_stats_sync structures for lockdep
  locking: Move the percpu-rwsem code to kernel/locking/
  locking: Move the lglocks code to kernel/locking/
  locking: Move the rwsem code to kernel/locking/
  locking: Move the rtmutex code to kernel/locking/
  locking: Move the semaphore core to kernel/locking/
  locking: Move the spinlock code to kernel/locking/
  locking: Move the lockdep code to kernel/locking/
  locking: Move the mutex code to kernel/locking/
  hung_task debugging: Add tracepoint to report the hang
  x86/locking/kconfig: Update paravirt spinlock Kconfig description
  lockstat: Report avg wait and hold times
  lockdep, x86/alternatives: Drop ancient lockdep fixup message
  ...

net: Explicitly initialize u64_stats_sync structures for lockdep

2013-11-06T11:40:25+00:00

In order to enable lockdep on seqcount/seqlock structures, we
must explicitly initialize any locks.

The u64_stats_sync structure, uses a seqcount, and thus we need
to introduce a u64_stats_init() function and use it to initialize
the structure.

This unfortunately adds a lot of fairly trivial initialization code
to a number of drivers. But the benefit of ensuring correctness makes
this worth while.

Because these changes are required for lockdep to be enabled, and the
changes are quite trivial, I've not yet split this patch out into 30-some
separate patches, as I figured it would be better to get the various
maintainers thoughts on how to best merge this change along with
the seqcount lockdep enablement.

Feedback would be appreciated!

Signed-off-by: John Stultz 
Acked-by: Julian Anastasov 
Signed-off-by: Peter Zijlstra 
Cc: Alexey Kuznetsov 
Cc: "David S. Miller" 
Cc: Eric Dumazet 
Cc: Hideaki YOSHIFUJI 
Cc: James Morris 
Cc: Jesse Gross 
Cc: Mathieu Desnoyers 
Cc: "Michael S. Tsirkin" 
Cc: Mirko Lindner 
Cc: Patrick McHardy 
Cc: Roger Luethi 
Cc: Rusty Russell 
Cc: Simon Horman 
Cc: Stephen Hemminger 
Cc: Steven Rostedt 
Cc: Thomas Petazzoni 
Cc: Wensong Zhang 
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/1381186321-4906-2-git-send-email-john.stultz@linaro.org
Signed-off-by: Ingo Molnar

vxlan: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...))

2013-11-05T01:02:33+00:00

trivial patch converting ERR_PTR(PTR_ERR()) into ERR_CAST().
No functional changes.

Signed-off-by: Duan Jiong 
Signed-off-by: David S. Miller

vxlan: Have the NIC drivers do less work for offloads

2013-10-29T09:39:13+00:00

This patch removes the burden from the NIC drivers to check if the
vxlan driver is enabled in the kernel and also makes available
the vxlan headrooms to them.

Signed-off-by: Joseph Gasparakis 
Tested-by: Kavindya Deegala 
Signed-off-by: Jeff Kirsher