linux-stable.git/net/bridge, branch linux-4.5.y

bridge: fix igmp / mld query parsing

2016-05-19T01:35:07+00:00

[ Upstream commit 856ce5d083e14571d051301fe3c65b32b8cbe321 ]

With the newly introduced helper functions the skb pulling is hidden
in the checksumming function - and undone before returning to the
caller.

The IGMP and MLD query parsing functions in the bridge still
assumed that the skb is pointing to the beginning of the IGMP/MLD
message while it is now kept at the beginning of the IPv4/6 header.

If there is a querier somewhere else, then this either causes
the multicast snooping to stay disabled even though it could be
enabled. Or, if we have the querier enabled too, then this can
create unnecessary IGMP / MLD query messages on the link.

Fixing this by taking the offset between IP and IGMP/MLD header into
account, too.

Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code")
Reported-by: Simon Wunderlich 
Signed-off-by: Linus Lüssing 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: bridge: fix old ioctl unlocked net device walk

2016-05-19T01:35:07+00:00

[ Upstream commit 31ca0458a61a502adb7ed192bf9716c6d05791a5 ]

get_bridge_ifindices() is used from the old "deviceless" bridge ioctl
calls which aren't called with rtnl held. The comment above says that it is
called with rtnl but that is not really the case.
Here's a sample output from a test ASSERT_RTNL() which I put in
get_bridge_ifindices and executed "brctl show":
[  957.422726] RTNL: assertion failed at net/bridge//br_ioctl.c (30)
[  957.422925] CPU: 0 PID: 1862 Comm: brctl Tainted: G        W  O
4.6.0-rc4+ #157
[  957.423009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.8.1-20150318_183358- 04/01/2014
[  957.423009]  0000000000000000 ffff880058adfdf0 ffffffff8138dec5
0000000000000400
[  957.423009]  ffffffff81ce8380 ffff880058adfe58 ffffffffa05ead32
0000000000000001
[  957.423009]  00007ffec1a444b0 0000000000000400 ffff880053c19130
0000000000008940
[  957.423009] Call Trace:
[  957.423009]  [] dump_stack+0x85/0xc0
[  957.423009]  []
br_ioctl_deviceless_stub+0x212/0x2e0 [bridge]
[  957.423009]  [] sock_ioctl+0x22b/0x290
[  957.423009]  [] do_vfs_ioctl+0x95/0x700
[  957.423009]  [] SyS_ioctl+0x79/0x90
[  957.423009]  [] entry_SYSCALL_64_fastpath+0x23/0xc1

Since it only reads bridge ifindices, we can use rcu to safely walk the net
device list. Also remove the wrong rtnl comment above.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: Allow set bridge ageing time when switchdev disabled

2016-04-20T06:45:16+00:00

[ Upstream commit 5e263f712691615fb802f06c98d7638c378f5d11 ]

When NET_SWITCHDEV=n, switchdev_port_attr_set will return -EOPNOTSUPP,
we should ignore this error code and continue to set the ageing time.

Fixes: c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev")
Signed-off-by: Haishuang Yan 
Acked-by: Ido Schimmel 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bridge: allow zero ageing time

2016-04-20T06:45:12+00:00

[ Upstream commit 4c656c13b254d598e83e586b7b4d36a2043dad85 ]

This fixes a regression in the bridge ageing time caused by:
commit c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev")

There are users of Linux bridge which use the feature that if ageing time
is set to 0 it causes entries to never expire. See:
  https://www.linuxfoundation.org/collaborate/workgroups/networking/bridge

For a pure software bridge, it is unnecessary for the code to have
arbitrary restrictions on what values are allowable.

Signed-off-by: Stephen Hemminger 
Acked-by: Jiri Pirko 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: ndo_fdb_dump should report -EMSGSIZE to rtnl_fdb_dump.

2016-02-26T20:04:02+00:00

When the send skbuff reaches the end, nlmsg_put and friends returns
-EMSGSIZE but it is silently thrown away in ndo_fdb_dump. It is called
within a for_each_netdev loop and the first fdb entry of a following
netdev could fit in the remaining skbuff.  This breaks the mechanism
of cb->args[0] and idx to keep track of the entries that are already
dumped, which results missing entries in bridge fdb show command.

Signed-off-by: Minoura Makoto 
Signed-off-by: David S. Miller

bridge: mdb: avoid uninitialized variable warning

2016-02-16T20:37:28+00:00

A recent change to the mdb code confused the compiler to the point
where it did not realize that the port-group returned from
br_mdb_add_group() is always valid when the function returns a nonzero
return value, so we get a spurious warning:

net/bridge/br_mdb.c: In function 'br_mdb_add':
net/bridge/br_mdb.c:542:4: error: 'pg' may be used uninitialized in this function [-Werror=maybe-uninitialized]
    __br_mdb_notify(dev, entry, RTM_NEWMDB, pg);

Slightly rearranging the code in br_mdb_add_group() makes the problem
go away, as gcc is clever enough to see that both functions check
for 'ret != 0'.

Signed-off-by: Arnd Bergmann 
Fixes: 9e8430f8d60d ("bridge: mdb: Passing the port-group pointer to br_mdb module")
Signed-off-by: David S. Miller

switchdev: Require RTNL mutex to be held when sending FDB notifications

2016-01-29T00:21:31+00:00

When switchdev drivers process FDB notifications from the underlying
device they resolve the netdev to which the entry points to and notify
the bridge using the switchdev notifier.

However, since the RTNL mutex is not held there is nothing preventing
the netdev from disappearing in the middle, which will cause
br_switchdev_event() to dereference a non-existing netdev.

Make switchdev drivers hold the lock at the beginning of the
notification processing session and release it once it ends, after
notifying the bridge.

Also, remove switchdev_mutex and fdb_lock, as they are no longer needed
when RTNL mutex is held.

Fixes: 03bf0c281234 ("switchdev: introduce switchdev notifier")
Signed-off-by: Ido Schimmel 
Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

bridge: fix lockdep addr_list_lock false positive splat

2016-01-15T20:40:45+00:00

After promisc mode management was introduced a bridge device could do
dev_set_promiscuity from its ndo_change_rx_flags() callback which in
turn can be called after the bridge's addr_list_lock has been taken
(e.g. by dev_uc_add). This causes a false positive lockdep splat because
the port interfaces' addr_list_lock is taken when br_manage_promisc()
runs after the bridge's addr list lock was already taken.
To remove the false positive introduce a custom bridge addr_list_lock
class and set it on bridge init.
A simple way to reproduce this is with the following:
$ brctl addbr br0
$ ip l add l br0 br0.100 type vlan id 100
$ ip l set br0 up
$ ip l set br0.100 up
$ echo 1 > /sys/class/net/br0/bridge/vlan_filtering
$ brctl addif br0 eth0
Splat:
[   43.684325] =============================================
[   43.684485] [ INFO: possible recursive locking detected ]
[   43.684636] 4.4.0-rc8+ #54 Not tainted
[   43.684755] ---------------------------------------------
[   43.684906] brctl/1187 is trying to acquire lock:
[   43.685047]  (_xmit_ETHER){+.....}, at: [] dev_set_rx_mode+0x1e/0x40
[   43.685460]  but task is already holding lock:
[   43.685618]  (_xmit_ETHER){+.....}, at: [] dev_uc_add+0x27/0x80
[   43.686015]  other info that might help us debug this:
[   43.686316]  Possible unsafe locking scenario:

[   43.686743]        CPU0
[   43.686967]        ----
[   43.687197]   lock(_xmit_ETHER);
[   43.687544]   lock(_xmit_ETHER);
[   43.687886] *** DEADLOCK ***

[   43.688438]  May be due to missing lock nesting notation

[   43.688882] 2 locks held by brctl/1187:
[   43.689134]  #0:  (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x20
[   43.689852]  #1:  (_xmit_ETHER){+.....}, at: [] dev_uc_add+0x27/0x80
[   43.690575] stack backtrace:
[   43.690970] CPU: 0 PID: 1187 Comm: brctl Not tainted 4.4.0-rc8+ #54
[   43.691270] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
[   43.691770]  ffffffff826a25c0 ffff8800369fb8e0 ffffffff81360ceb ffffffff826a25c0
[   43.692425]  ffff8800369fb9b8 ffffffff810d0466 ffff8800369fb968 ffffffff81537139
[   43.693071]  ffff88003a08c880 0000000000000000 00000000ffffffff 0000000002080020
[   43.693709] Call Trace:
[   43.693931]  [] dump_stack+0x4b/0x70
[   43.694199]  [] __lock_acquire+0x1e46/0x1e90
[   43.694483]  [] ? netlink_broadcast_filtered+0x139/0x3e0
[   43.694789]  [] ? nlmsg_notify+0x5a/0xc0
[   43.695064]  [] lock_acquire+0xe5/0x1f0
[   43.695340]  [] ? dev_set_rx_mode+0x1e/0x40
[   43.695623]  [] _raw_spin_lock_bh+0x45/0x80
[   43.695901]  [] ? dev_set_rx_mode+0x1e/0x40
[   43.696180]  [] dev_set_rx_mode+0x1e/0x40
[   43.696460]  [] dev_set_promiscuity+0x3c/0x50
[   43.696750]  [] br_port_set_promisc+0x25/0x50 [bridge]
[   43.697052]  [] br_manage_promisc+0x8a/0xe0 [bridge]
[   43.697348]  [] br_dev_change_rx_flags+0x1e/0x20 [bridge]
[   43.697655]  [] __dev_set_promiscuity+0x132/0x1f0
[   43.697943]  [] __dev_set_rx_mode+0x82/0x90
[   43.698223]  [] dev_uc_add+0x5e/0x80
[   43.698498]  [] vlan_device_event+0x542/0x650 [8021q]
[   43.698798]  [] notifier_call_chain+0x5d/0x80
[   43.699083]  [] raw_notifier_call_chain+0x16/0x20
[   43.699374]  [] call_netdevice_notifiers_info+0x6e/0x80
[   43.699678]  [] call_netdevice_notifiers+0x16/0x20
[   43.699973]  [] br_add_if+0x47e/0x4c0 [bridge]
[   43.700259]  [] add_del_if+0x6e/0x80 [bridge]
[   43.700548]  [] br_dev_ioctl+0xaf/0xc0 [bridge]
[   43.700836]  [] dev_ifsioc+0x30c/0x3c0
[   43.701106]  [] dev_ioctl+0xf9/0x6f0
[   43.701379]  [] ? mntput_no_expire+0x5/0x450
[   43.701665]  [] ? mntput_no_expire+0xae/0x450
[   43.701947]  [] sock_do_ioctl+0x42/0x50
[   43.702219]  [] sock_ioctl+0x1e5/0x290
[   43.702500]  [] do_vfs_ioctl+0x2cb/0x5c0
[   43.702771]  [] SyS_ioctl+0x79/0x90
[   43.703033]  [] entry_SYSCALL_64_fastpath+0x16/0x7a

CC: Vlad Yasevich 
CC: Stephen Hemminger 
CC: Bridge list 
CC: Andy Gospodarek 
CC: Roopa Prabhu 
Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
Reported-by: Andy Gospodarek 
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bridge: Reflect MDB entries to hardware

2016-01-10T21:50:21+00:00

Offload MDB changes per port to hardware

Signed-off-by: Elad Raz 
Signed-off-by: Ido Schimmel 
Signed-off-by: Jiri Pirko 
Reviewed-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2016-01-09T01:53:16+00:00

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for net-next, they are:

1) Release nf_tables objects on netns destructions via
   nft_release_afinfo().

2) Destroy basechain and rules on netdevice removal in the new netdev
   family.

3) Get rid of defensive check against removal of inactive objects in
   nf_tables.

4) Pass down netns pointer to our existing nfnetlink callbacks, as well
   as commit() and abort() nfnetlink callbacks.

5) Allow to invert limit expression in nf_tables, so we can throttle
   overlimit traffic.

6) Add packet duplication for the netdev family.

7) Add forward expression for the netdev family.

8) Define pr_fmt() in conntrack helpers.

9) Don't leave nfqueue configuration on inconsistent state in case of
   errors, from Ken-ichirou MATSUZAWA, follow up patches are also from
   him.

10) Skip queue option handling after unbind.

11) Return error on unknown both in nfqueue and nflog command.

12) Autoload ctnetlink when NFQA_CFG_F_CONNTRACK is set.

13) Add new NFTA_SET_USERDATA attribute to store user data in sets,
    from Carlos Falgueras.

14) Add support for 64 bit byteordering changes nf_tables, from Florian
    Westphal.

15) Add conntrack byte/packet counter matching support to nf_tables,
    also from Florian.
====================

Signed-off-by: David S. Miller