linux-stable.git/net/core, branch v3.2.5

net: reintroduce missing rcu_assign_pointer() calls

2012-02-03T17:22:20+00:00

[ Upstream commit cf778b00e96df6d64f8e21b8395d1f8a859ecdc7 ]

commit a9b3cd7f32 (rcu: convert uses of rcu_assign_pointer(x, NULL) to
RCU_INIT_POINTER) did a lot of incorrect changes, since it did a
complete conversion of rcu_assign_pointer(x, y) to RCU_INIT_POINTER(x,
y).

We miss needed barriers, even on x86, when y is not NULL.

Signed-off-by: Eric Dumazet 
CC: Stephen Hemminger 
CC: Paul E. McKenney 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

netns: fix net_alloc_generic()

2012-02-03T17:22:17+00:00

[ Upstream commit 073862ba5d249c20bd5c49fc6d904ff0e1f6a672 ]

When a new net namespace is created, we should attach to it a "struct
net_generic" with enough slots (even empty), or we can hit the following
BUG_ON() :

[  200.752016] kernel BUG at include/net/netns/generic.h:40!
...
[  200.752016]  [] ? get_cfcnfg+0x3a/0x180
[  200.752016]  [] ? lockdep_rtnl_is_held+0x10/0x20
[  200.752016]  [] caif_device_notify+0x2e/0x530
[  200.752016]  [] notifier_call_chain+0x67/0x110
[  200.752016]  [] raw_notifier_call_chain+0x11/0x20
[  200.752016]  [] call_netdevice_notifiers+0x32/0x60
[  200.752016]  [] register_netdevice+0x196/0x300
[  200.752016]  [] register_netdev+0x19/0x30
[  200.752016]  [] loopback_net_init+0x4a/0xa0
[  200.752016]  [] ops_init+0x42/0x180
[  200.752016]  [] setup_net+0x6b/0x100
[  200.752016]  [] copy_net_ns+0x86/0x110
[  200.752016]  [] create_new_namespaces+0xd9/0x190

net_alloc_generic() should take into account the maximum index into the
ptr array, as a subsystem might use net_generic() anytime.

This also reduces number of reallocations in net_assign_generic()

Reported-by: Sasha Levin 
Tested-by: Sasha Levin 
Signed-off-by: Eric Dumazet 
Cc: Sjur Brændeland 
Cc: Eric W. Biederman 
Cc: Pavel Emelyanov 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: relax rcvbuf limits

2011-12-23T07:15:14+00:00

skb->truesize might be big even for a small packet.

Its even bigger after commit 87fb4b7b533 (net: more accurate skb
truesize) and big MTU.

We should allow queueing at least one packet per receiver, even with a
low RCVBUF setting.

Reported-by: Michal Simek 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

rps: fix insufficient bounds checking in store_rps_dev_flow_table_cnt()

2011-12-23T03:34:56+00:00

Setting a large rps_flow_cnt like (1 << 30) on 32-bit platform will
cause a kernel oops due to insufficient bounds checking.

	if (count > 1<<30) {
		/* Enforce a limit to prevent overflow */
		return -EINVAL;
	}
	count = roundup_pow_of_two(count);
	table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));

Note that the macro RPS_DEV_FLOW_TABLE_SIZE(count) is defined as:

	... + (count * sizeof(struct rps_dev_flow))

where sizeof(struct rps_dev_flow) is 8.  (1 << 30) * 8 will overflow
32 bits.

This patch replaces the magic number (1 << 30) with a symbolic bound.

Suggested-by: Eric Dumazet 
Signed-off-by: Xi Wang 
Signed-off-by: David S. Miller

net: Add a flow_cache_flush_deferred function

2011-12-21T21:48:08+00:00

flow_cach_flush() might sleep but can be called from
atomic context via the xfrm garbage collector. So add
a flow_cache_flush_deferred() function and use this if
the xfrm garbage colector is invoked from within the
packet path.

Signed-off-by: Steffen Klassert 
Acked-by: Timo Teräs 
Signed-off-by: David S. Miller

net: Silence seq_scale() unused warning

2011-12-06T18:59:16+00:00

On a CONFIG_NET=y build

net/core/secure_seq.c:22: warning: 'seq_scale' defined but not
used

Signed-off-by: Stephen Boyd 
Signed-off-by: David S. Miller

ipv4:correct description for tcp_max_syn_backlog

2011-12-06T18:02:28+00:00

Since commit c5ed63d66f24(tcp: fix three tcp sysctls tuning),
sysctl_max_syn_backlog is determined by tcp_hashinfo->ehash_mask,
and the minimal value is 128, and it will increase in proportion to the
memory of machine.
The original description for tcp_max_syn_backlog and sysctl_max_syn_backlog
are out of date.

Changelog:
V2: update description for sysctl_max_syn_backlog

Signed-off-by: Weiping Pan 
Reviewed-by: Shan Wei 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller

net/core: fix rollback handler in register_netdevice_notifier

2011-12-01T04:43:07+00:00

Within nested statements, the break statement terminates only the
do, for, switch, or while statement that immediately encloses it,
So replace the break with goto.

Signed-off-by: RongQing.Li 
Signed-off-by: David S. Miller

net: Fix corruption in /proc/*/net/dev_mcast

2011-11-28T23:07:29+00:00

I just hit this during my testing. Isn't there another bug lurking?

BUG kmalloc-8: Redzone overwritten

INFO: 0xc0000000de9dec48-0xc0000000de9dec4b. First byte 0x0 instead of 0xcc
INFO: Allocated in .__seq_open_private+0x30/0xa0 age=0 cpu=5 pid=3896
	.__kmalloc+0x1e0/0x2d0
	.__seq_open_private+0x30/0xa0
	.seq_open_net+0x60/0xe0
	.dev_mc_seq_open+0x4c/0x70
	.proc_reg_open+0xd8/0x260
	.__dentry_open.clone.11+0x2b8/0x400
	.do_last+0xf4/0x950
	.path_openat+0xf8/0x480
	.do_filp_open+0x48/0xc0
	.do_sys_open+0x140/0x250
	syscall_exit+0x0/0x40

dev_mc_seq_ops uses dev_seq_start/next/stop but only allocates
sizeof(struct seq_net_private) of private data, whereas it expects
sizeof(struct dev_iter_state):

struct dev_iter_state {
	struct seq_net_private p;
	unsigned int pos; /* bucket << BUCKET_SPACE + offset */
};

Create dev_seq_open_ops and use it so we don't have to expose
struct dev_iter_state.

[ Problem added by commit f04565ddf52e4 (dev: use name hash for
  dev_seq_ops) -Eric ]

Signed-off-by: Anton Blanchard 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

netns: fix proxy ARP entries listing on a netns

2011-11-25T18:24:49+00:00

Skip entries from foreign network namespaces.

Signed-off-by: Jorge Boncompte [DTI2] 
Signed-off-by: David S. Miller