linux-stable.git/net/l2tp, branch v3.12

l2tp: must disable bh before calling l2tp_xmit_skb()

2013-10-11T20:51:37+00:00

François Cachereul made a very nice bug report and suspected
the bh_lock_sock() / bh_unlok_sock() pair used in l2tp_xmit_skb() from
process context was not good.

This problem was added by commit 6af88da14ee284aaad6e4326da09a89191ab6165
("l2tp: Fix locking in l2tp_core.c").

l2tp_eth_dev_xmit() runs from BH context, so we must disable BH
from other l2tp_xmit_skb() users.

[  452.060011] BUG: soft lockup - CPU#1 stuck for 23s! [accel-pppd:6662]
[  452.061757] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core pppoe pppox
ppp_generic slhc ipv6 ext3 mbcache jbd virtio_balloon xfs exportfs dm_mod
virtio_blk ata_generic virtio_net floppy ata_piix libata virtio_pci virtio_ring virtio [last unloaded: scsi_wait_scan]
[  452.064012] CPU 1
[  452.080015] BUG: soft lockup - CPU#2 stuck for 23s! [accel-pppd:6643]
[  452.080015] CPU 2
[  452.080015]
[  452.080015] Pid: 6643, comm: accel-pppd Not tainted 3.2.46.mini #1 Bochs Bochs
[  452.080015] RIP: 0010:[]  [] do_raw_spin_lock+0x17/0x1f
[  452.080015] RSP: 0018:ffff88007125fc18  EFLAGS: 00000293
[  452.080015] RAX: 000000000000aba9 RBX: ffffffff811d0703 RCX: 0000000000000000
[  452.080015] RDX: 00000000000000ab RSI: ffff8800711f6896 RDI: ffff8800745c8110
[  452.080015] RBP: ffff88007125fc18 R08: 0000000000000020 R09: 0000000000000000
[  452.080015] R10: 0000000000000000 R11: 0000000000000280 R12: 0000000000000286
[  452.080015] R13: 0000000000000020 R14: 0000000000000240 R15: 0000000000000000
[  452.080015] FS:  00007fdc0cc24700(0000) GS:ffff8800b6f00000(0000) knlGS:0000000000000000
[  452.080015] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  452.080015] CR2: 00007fdb054899b8 CR3: 0000000074404000 CR4: 00000000000006a0
[  452.080015] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  452.080015] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  452.080015] Process accel-pppd (pid: 6643, threadinfo ffff88007125e000, task ffff8800b27e6dd0)
[  452.080015] Stack:
[  452.080015]  ffff88007125fc28 ffffffff81256559 ffff88007125fc98 ffffffffa01b2bd1
[  452.080015]  ffff88007125fc58 000000000000000c 00000000029490d0 0000009c71dbe25e
[  452.080015]  000000000000005c 000000080000000e 0000000000000000 ffff880071170600
[  452.080015] Call Trace:
[  452.080015]  [] _raw_spin_lock+0xe/0x10
[  452.080015]  [] l2tp_xmit_skb+0x189/0x4ac [l2tp_core]
[  452.080015]  [] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp]
[  452.080015]  [] __sock_sendmsg_nosec+0x22/0x24
[  452.080015]  [] sock_sendmsg+0xa1/0xb6
[  452.080015]  [] ? __schedule+0x5c1/0x616
[  452.080015]  [] ? __dequeue_signal+0xb7/0x10c
[  452.080015]  [] ? fget_light+0x75/0x89
[  452.080015]  [] ? sockfd_lookup_light+0x20/0x56
[  452.080015]  [] sys_sendto+0x10c/0x13b
[  452.080015]  [] system_call_fastpath+0x16/0x1b
[  452.080015] Code: 81 48 89 e5 72 0c 31 c0 48 81 ff 45 66 25 81 0f 92 c0 5d c3 55 b8 00 01 00 00 48 89 e5 f0 66 0f c1 07 0f b6 d4 38 d0 74 06 f3 90 <8a> 07 eb f6 5d c3 90 90 55 48 89 e5 9c 58 0f 1f 44 00 00 5d c3
[  452.080015] Call Trace:
[  452.080015]  [] _raw_spin_lock+0xe/0x10
[  452.080015]  [] l2tp_xmit_skb+0x189/0x4ac [l2tp_core]
[  452.080015]  [] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp]
[  452.080015]  [] __sock_sendmsg_nosec+0x22/0x24
[  452.080015]  [] sock_sendmsg+0xa1/0xb6
[  452.080015]  [] ? __schedule+0x5c1/0x616
[  452.080015]  [] ? __dequeue_signal+0xb7/0x10c
[  452.080015]  [] ? fget_light+0x75/0x89
[  452.080015]  [] ? sockfd_lookup_light+0x20/0x56
[  452.080015]  [] sys_sendto+0x10c/0x13b
[  452.080015]  [] system_call_fastpath+0x16/0x1b
[  452.064012]
[  452.064012] Pid: 6662, comm: accel-pppd Not tainted 3.2.46.mini #1 Bochs Bochs
[  452.064012] RIP: 0010:[]  [] do_raw_spin_lock+0x19/0x1f
[  452.064012] RSP: 0018:ffff8800b6e83ba0  EFLAGS: 00000297
[  452.064012] RAX: 000000000000aaa9 RBX: ffff8800b6e83b40 RCX: 0000000000000002
[  452.064012] RDX: 00000000000000aa RSI: 000000000000000a RDI: ffff8800745c8110
[  452.064012] RBP: ffff8800b6e83ba0 R08: 000000000000c802 R09: 000000000000001c
[  452.064012] R10: ffff880071096c4e R11: 0000000000000006 R12: ffff8800b6e83b18
[  452.064012] R13: ffffffff8125d51e R14: ffff8800b6e83ba0 R15: ffff880072a589c0
[  452.064012] FS:  00007fdc0b81e700(0000) GS:ffff8800b6e80000(0000) knlGS:0000000000000000
[  452.064012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  452.064012] CR2: 0000000000625208 CR3: 0000000074404000 CR4: 00000000000006a0
[  452.064012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  452.064012] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  452.064012] Process accel-pppd (pid: 6662, threadinfo ffff88007129a000, task ffff8800744f7410)
[  452.064012] Stack:
[  452.064012]  ffff8800b6e83bb0 ffffffff81256559 ffff8800b6e83bc0 ffffffff8121c64a
[  452.064012]  ffff8800b6e83bf0 ffffffff8121ec7a ffff880072a589c0 ffff880071096c62
[  452.064012]  0000000000000011 ffffffff81430024 ffff8800b6e83c80 ffffffff8121f276
[  452.064012] Call Trace:
[  452.064012]  
[  452.064012]  [] _raw_spin_lock+0xe/0x10
[  452.064012]  [] spin_lock+0x9/0xb
[  452.064012]  [] udp_queue_rcv_skb+0x186/0x269
[  452.064012]  [] __udp4_lib_rcv+0x297/0x4ae
[  452.064012]  [] ? raw_rcv+0xe9/0xf0
[  452.064012]  [] udp_rcv+0x1a/0x1c
[  452.064012]  [] ip_local_deliver_finish+0x12b/0x1a5
[  452.064012]  [] ip_local_deliver+0x53/0x84
[  452.064012]  [] ip_rcv_finish+0x2bc/0x2f3
[  452.064012]  [] ip_rcv+0x210/0x269
[  452.064012]  [] ? kvm_clock_get_cycles+0x9/0xb
[  452.064012]  [] __netif_receive_skb+0x3a5/0x3f7
[  452.064012]  [] netif_receive_skb+0x57/0x5e
[  452.064012]  [] ? __netdev_alloc_skb+0x1f/0x3b
[  452.064012]  [] virtnet_poll+0x4ba/0x5a4 [virtio_net]
[  452.064012]  [] net_rx_action+0x73/0x184
[  452.064012]  [] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core]
[  452.064012]  [] __do_softirq+0xc3/0x1a8
[  452.064012]  [] ? ack_APIC_irq+0x10/0x12
[  452.064012]  [] ? _raw_spin_lock+0xe/0x10
[  452.064012]  [] call_softirq+0x1c/0x26
[  452.064012]  [] do_softirq+0x45/0x82
[  452.064012]  [] irq_exit+0x42/0x9c
[  452.064012]  [] do_IRQ+0x8e/0xa5
[  452.064012]  [] common_interrupt+0x6e/0x6e
[  452.064012]  
[  452.064012]  [] ? kfree+0x8a/0xa3
[  452.064012]  [] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core]
[  452.064012]  [] ? l2tp_xmit_skb+0x1dd/0x4ac [l2tp_core]
[  452.064012]  [] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp]
[  452.064012]  [] __sock_sendmsg_nosec+0x22/0x24
[  452.064012]  [] sock_sendmsg+0xa1/0xb6
[  452.064012]  [] ? __schedule+0x5c1/0x616
[  452.064012]  [] ? __dequeue_signal+0xb7/0x10c
[  452.064012]  [] ? fget_light+0x75/0x89
[  452.064012]  [] ? sockfd_lookup_light+0x20/0x56
[  452.064012]  [] sys_sendto+0x10c/0x13b
[  452.064012]  [] system_call_fastpath+0x16/0x1b
[  452.064012] Code: 89 e5 72 0c 31 c0 48 81 ff 45 66 25 81 0f 92 c0 5d c3 55 b8 00 01 00 00 48 89 e5 f0 66 0f c1 07 0f b6 d4 38 d0 74 06 f3 90 8a 07  f6 5d c3 90 90 55 48 89 e5 9c 58 0f 1f 44 00 00 5d c3 55 48
[  452.064012] Call Trace:
[  452.064012]    [] _raw_spin_lock+0xe/0x10
[  452.064012]  [] spin_lock+0x9/0xb
[  452.064012]  [] udp_queue_rcv_skb+0x186/0x269
[  452.064012]  [] __udp4_lib_rcv+0x297/0x4ae
[  452.064012]  [] ? raw_rcv+0xe9/0xf0
[  452.064012]  [] udp_rcv+0x1a/0x1c
[  452.064012]  [] ip_local_deliver_finish+0x12b/0x1a5
[  452.064012]  [] ip_local_deliver+0x53/0x84
[  452.064012]  [] ip_rcv_finish+0x2bc/0x2f3
[  452.064012]  [] ip_rcv+0x210/0x269
[  452.064012]  [] ? kvm_clock_get_cycles+0x9/0xb
[  452.064012]  [] __netif_receive_skb+0x3a5/0x3f7
[  452.064012]  [] netif_receive_skb+0x57/0x5e
[  452.064012]  [] ? __netdev_alloc_skb+0x1f/0x3b
[  452.064012]  [] virtnet_poll+0x4ba/0x5a4 [virtio_net]
[  452.064012]  [] net_rx_action+0x73/0x184
[  452.064012]  [] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core]
[  452.064012]  [] __do_softirq+0xc3/0x1a8
[  452.064012]  [] ? ack_APIC_irq+0x10/0x12
[  452.064012]  [] ? _raw_spin_lock+0xe/0x10
[  452.064012]  [] call_softirq+0x1c/0x26
[  452.064012]  [] do_softirq+0x45/0x82
[  452.064012]  [] irq_exit+0x42/0x9c
[  452.064012]  [] do_IRQ+0x8e/0xa5
[  452.064012]  [] common_interrupt+0x6e/0x6e
[  452.064012]    [] ? kfree+0x8a/0xa3
[  452.064012]  [] ? l2tp_xmit_skb+0x27a/0x4ac [l2tp_core]
[  452.064012]  [] ? l2tp_xmit_skb+0x1dd/0x4ac [l2tp_core]
[  452.064012]  [] pppol2tp_sendmsg+0x15e/0x19c [l2tp_ppp]
[  452.064012]  [] __sock_sendmsg_nosec+0x22/0x24
[  452.064012]  [] sock_sendmsg+0xa1/0xb6
[  452.064012]  [] ? __schedule+0x5c1/0x616
[  452.064012]  [] ? __dequeue_signal+0xb7/0x10c
[  452.064012]  [] ? fget_light+0x75/0x89
[  452.064012]  [] ? sockfd_lookup_light+0x20/0x56
[  452.064012]  [] sys_sendto+0x10c/0x13b
[  452.064012]  [] system_call_fastpath+0x16/0x1b

Reported-by: François Cachereul 
Tested-by: François Cachereul 
Signed-off-by: Eric Dumazet 
Cc: James Chapman 
Signed-off-by: David S. Miller

l2tp: Fix build warning with ipv6 disabled.

2013-10-08T19:44:26+00:00

net/l2tp/l2tp_core.c: In function ‘l2tp_verify_udp_checksum’:
net/l2tp/l2tp_core.c:499:22: warning: unused variable ‘tunnel’ [-Wunused-variable]

Create a helper "l2tp_tunnel()" to facilitate this, and as a side
effect get rid of a bunch of unnecessary void pointer casts.

Signed-off-by: David S. Miller

l2tp: fix kernel panic when using IPv4-mapped IPv6 addresses

2013-10-02T21:09:22+00:00

IPv4 mapped addresses cause kernel panic.
The patch juste check whether the IPv6 address is an IPv4 mapped
address. If so, use IPv4 API instead of IPv6.

[  940.026915] general protection fault: 0000 [#1]
[  940.026915] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core pppox ppp_generic slhc loop psmouse
[  940.026915] CPU: 0 PID: 3184 Comm: memcheck-amd64- Not tainted 3.11.0+ #1
[  940.026915] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[  940.026915] task: ffff880007130e20 ti: ffff88000737e000 task.ti: ffff88000737e000
[  940.026915] RIP: 0010:[]  [] ip6_xmit+0x276/0x326
[  940.026915] RSP: 0018:ffff88000737fd28  EFLAGS: 00010286
[  940.026915] RAX: c748521a75ceff48 RBX: ffff880000c30800 RCX: 0000000000000000
[  940.026915] RDX: ffff88000075cc4e RSI: 0000000000000028 RDI: ffff8800060e5a40
[  940.026915] RBP: ffff8800060e5a40 R08: 0000000000000000 R09: ffff88000075cc90
[  940.026915] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88000737fda0
[  940.026915] R13: 0000000000000000 R14: 0000000000002000 R15: ffff880005d3b580
[  940.026915] FS:  00007f163dc5e800(0000) GS:ffffffff81623000(0000) knlGS:0000000000000000
[  940.026915] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  940.026915] CR2: 00000004032dc940 CR3: 0000000005c25000 CR4: 00000000000006f0
[  940.026915] Stack:
[  940.026915]  ffff88000075cc4e ffffffff81694e90 ffff880000c30b38 0000000000000020
[  940.026915]  11000000523c4bac ffff88000737fdb4 0000000000000000 ffff880000c30800
[  940.026915]  ffff880005d3b580 ffff880000c30b38 ffff8800060e5a40 0000000000000020
[  940.026915] Call Trace:
[  940.026915]  [] ? inet6_csk_xmit+0xa4/0xc4
[  940.026915]  [] ? l2tp_xmit_skb+0x503/0x55a [l2tp_core]
[  940.026915]  [] ? pskb_expand_head+0x161/0x214
[  940.026915]  [] ? pppol2tp_xmit+0xf2/0x143 [l2tp_ppp]
[  940.026915]  [] ? ppp_channel_push+0x36/0x8b [ppp_generic]
[  940.026915]  [] ? ppp_write+0xaf/0xc5 [ppp_generic]
[  940.026915]  [] ? vfs_write+0xa2/0x106
[  940.026915]  [] ? SyS_write+0x56/0x8a
[  940.026915]  [] ? system_call_fastpath+0x16/0x1b
[  940.026915] Code: 00 49 8b 8f d8 00 00 00 66 83 7c 11 02 00 74 60 49
8b 47 58 48 83 e0 fe 48 8b 80 18 01 00 00 48 85 c0 74 13 48 8b 80 78 02
00 00 <48> ff 40 28 41 8b 57 68 48 01 50 30 48 8b 54 24 08 49 c7 c1 51
[  940.026915] RIP  [] ip6_xmit+0x276/0x326
[  940.026915]  RSP 
[  940.057945] ---[ end trace be8aba9a61c8b7f3 ]---
[  940.058583] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: François CACHEREUL 
Signed-off-by: David S. Miller

l2tp: make datapath resilient to packet loss when sequence numbers enabled

2013-07-02T23:33:25+00:00

If L2TP data sequence numbers are enabled and reordering is not
enabled, data reception stops if a packet is lost since the kernel
waits for a sequence number that is never resent. (When reordering is
enabled, data reception restarts when the reorder timeout expires.) If
no reorder timeout is set, we should count the number of in-sequence
packets after the out-of-sequence (OOS) condition is detected, and reset
sequence number state after a number of such packets are received.

For now, the number of in-sequence packets while in OOS state which
cause the sequence number state to be reset is hard-coded to 5. This
could be configurable later.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: make datapath sequence number support RFC-compliant

2013-07-02T23:33:24+00:00

The L2TP datapath is not currently RFC-compliant when sequence numbers
are used in L2TP data packets. According to the L2TP RFC, any received
sequence number NR greater than or equal to the next expected NR is
acceptable, where the "greater than or equal to" test is determined by
the NR wrap point. This differs for L2TPv2 and L2TPv3, so add state in
the session context to hold the max NR value and the NR window size in
order to do the acceptable sequence number value check. These might be
configurable later, but for now we derive it from the tunnel L2TP
version, which determines the sequence number field size.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: do data sequence number handling in a separate func

2013-07-02T23:33:24+00:00

This change moves some code handling data sequence numbers into a
separate function to avoid too much indentation. This is to prepare
for some changes to data sequence number handling in subsequent
patches.

Signed-off-by: James Chapman 
Signed-off-by: David S. Miller

l2tp: add missing .owner to struct pppox_proto

2013-07-02T08:11:56+00:00

Add missing .owner of struct pppox_proto. This prevents the
module from being removed from underneath its users.

Signed-off-by: Wei Yongjun 
Signed-off-by: David S. Miller

l2tp: Fix sendmsg() return value

2013-06-13T09:39:04+00:00

PPPoL2TP sockets should comply with the standard send*() return values
(i.e. return number of bytes sent instead of 0 upon success).

Signed-off-by: Guillaume Nault 
Signed-off-by: David S. Miller

l2tp: Fix PPP header erasure and memory leak

2013-06-13T09:39:04+00:00

Copy user data after PPP framing header. This prevents erasure of the
added PPP header and avoids leaking two bytes of uninitialised memory
at the end of skb's data buffer.

Signed-off-by: Guillaume Nault 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-04-07T22:37:01+00:00

Conflicts:
	drivers/nfc/microread/mei.c
	net/netfilter/nfnetlink_queue_core.c

Pull in 'net' to get Eric Biederman's AF_UNIX fix, upon which
some cleanups are going to go on-top.

Signed-off-by: David S. Miller