linux.git/net/core, branch v3.1-rc6

netpoll: fix incorrect access to skb data in __netpoll_rx

2011-08-26T16:49:04+00:00

__netpoll_rx() doesnt properly handle skbs with small header

pskb_may_pull() or pskb_trim_rcsum() can change skb->data, we must
reload it.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

arp: fix rcu lockdep splat in arp_process()

2011-08-25T00:55:00+00:00

Dave Jones reported a lockdep splat triggered by an arp_process() call
from parp_redo().

Commit faa9dcf793be (arp: RCU changes) is the origin of the bug, since
it assumed arp_process() was called under rcu_read_lock(), which is not
true in this particular path.

Instead of adding rcu_read_lock() in parp_redo(), I chose to add it in
neigh_proxy_process() to take care of IPv6 side too.

 ===================================================
 [ INFO: suspicious rcu_dereference_check() usage. ]
 ---------------------------------------------------
 include/linux/inetdevice.h:209 invoked rcu_dereference_check() without
protection!

 other info that might help us debug this:

 rcu_scheduler_active = 1, debug_locks = 0
 4 locks held by setfiles/2123:
  #0:  (&sb->s_type->i_mutex_key#13){+.+.+.}, at: []
walk_component+0x1ef/0x3e8
  #1:  (&isec->lock){+.+.+.}, at: []
inode_doinit_with_dentry+0x3f/0x41f
  #2:  (&tbl->proxy_timer){+.-...}, at: []
run_timer_softirq+0x157/0x372
  #3:  (class){+.-...}, at: [] neigh_proxy_process
+0x36/0x103

 stack backtrace:
 Pid: 2123, comm: setfiles Tainted: G        W
3.1.0-0.rc2.git7.2.fc16.x86_64 #1
 Call Trace:
    [] lockdep_rcu_dereference+0xa7/0xaf
  [] __in_dev_get_rcu+0x55/0x5d
  [] arp_process+0x25/0x4d7
  [] parp_redo+0xe/0x10
  [] neigh_proxy_process+0x9a/0x103
  [] run_timer_softirq+0x218/0x372
  [] ? run_timer_softirq+0x157/0x372
  [] ? neigh_stat_seq_open+0x41/0x41
  [] ? mark_held_locks+0x6d/0x95
  [] __do_softirq+0x112/0x25a
  [] call_softirq+0x1c/0x30
  [] do_softirq+0x4b/0xa2
  [] irq_exit+0x5d/0xcf
  [] smp_apic_timer_interrupt+0x7c/0x8a
  [] apic_timer_interrupt+0x73/0x80
    [] ? trace_hardirqs_on_caller+0x121/0x158
  [] ? __slab_free+0x30/0x24c
  [] ? __slab_free+0x2e/0x24c
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] kfree+0x108/0x131
  [] inode_doinit_with_dentry+0x2e9/0x41f
  [] selinux_d_instantiate+0x1c/0x1e
  [] security_d_instantiate+0x21/0x23
  [] d_instantiate+0x5c/0x61
  [] d_splice_alias+0xbc/0xd2
  [] ext4_lookup+0xba/0xeb
  [] d_alloc_and_lookup+0x45/0x6b
  [] walk_component+0x215/0x3e8
  [] lookup_last+0x3b/0x3d
  [] path_lookupat+0x82/0x2af
  [] ? might_fault+0xa5/0xac
  [] ? might_fault+0x5c/0xac
  [] ? getname_flags+0x31/0x1ca
  [] do_path_lookup+0x28/0x97
  [] user_path_at+0x59/0x96
  [] ? cp_new_stat+0xf7/0x10d
  [] vfs_fstatat+0x44/0x6e
  [] vfs_lstat+0x1e/0x20
  [] sys_newlstat+0x1a/0x33
  [] ? trace_hardirqs_on_caller+0x121/0x158
  [] ? trace_hardirqs_on_thunk+0x3a/0x3f
  [] system_call_fastpath+0x16/0x1b

Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

scm: Capture the full credentials of the scm sender

2011-08-11T12:52:57+00:00

This patch corrects an erroneous update of credential's gid with uid
introduced in commit 257b5358b32f17 since 2.6.36.

Signed-off-by: Tim Chen 
Acked-by: Eric Dumazet 
Reviewed-by: James Morris 
Signed-off-by: David S. Miller

net: Compute protocol sequence numbers and fragment IDs using MD5.

2011-08-07T01:33:19+00:00

Computers have become a lot faster since we compromised on the
partial MD4 hash which we use currently for performance reasons.

MD5 is a much safer choice, and is inline with both RFC1948 and
other ISS generators (OpenBSD, Solaris, etc.)

Furthermore, only having 24-bits of the sequence number be truly
unpredictable is a very serious limitation.  So the periodic
regeneration and 8-bit counter have been removed.  We compute and
use a full 32-bit sequence number.

For ipv6, DCCP was found to use a 32-bit truncated initial sequence
number (it needs 43-bits) and that is fixed here as well.

Reported-by: Dan Kaminsky 
Tested-by: Willy Tarreau 
Signed-off-by: David S. Miller

net: add kerneldoc to skb_copy_bits()

2011-08-02T01:03:06+00:00

Since skb_copy_bits() is called from assembly, add a fat comment to make
clear we should think twice before changing its prototype.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2011-07-28T12:58:19+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (32 commits)
  tg3: Remove 5719 jumbo frames and TSO blocks
  tg3: Break larger frags into 4k chunks for 5719
  tg3: Add tx BD budgeting code
  tg3: Consolidate code that calls tg3_tx_set_bd()
  tg3: Add partial fragment unmapping code
  tg3: Generalize tg3_skb_error_unmap()
  tg3: Remove short DMA check for 1st fragment
  tg3: Simplify tx bd assignments
  tg3: Reintroduce tg3_tx_ring_info
  ASIX: Use only 11 bits of header for data size
  ASIX: Simplify condition in rx_fixup()
  Fix cdc-phonet build
  bonding: reduce noise during init
  bonding: fix string comparison errors
  net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared
  net: add IFF_SKB_TX_SHARED flag to priv_flags
  net: sock_sendmsg_nosec() is static
  forcedeth: fix vlans
  gianfar: fix bug caused by 87c288c6e9aa31720b72e2bc2d665e24e1653c3e
  gro: Only reset frag0 when skb can be pulled
  ...

net: add IFF_SKB_TX_SHARED flag to priv_flags

2011-07-28T05:39:30+00:00

Pktgen attempts to transmit shared skbs to net devices, which can't be used by
some drivers as they keep state information in skbs.  This patch adds a flag
marking drivers as being able to handle shared skbs in their tx path.  Drivers
are defaulted to being unable to do so, but calling ether_setup enables this
flag, as 90% of the drivers calling ether_setup touch real hardware and can
handle shared skbs.  A subsequent patch will audit drivers to ensure that the
flag is set properly

Signed-off-by: Neil Horman 
Reported-by: Jiri Pirko 
CC: Robert Olsson 
CC: Eric Dumazet 
CC: Alexey Dobriyan 
CC: David S. Miller 
Signed-off-by: David S. Miller

atomic: use

2011-07-26T23:49:47+00:00

This allows us to move duplicated code in 
(atomic_inc_not_zero() for now) to 

Signed-off-by: Arun Sharma 
Reviewed-by: Eric Dumazet 
Cc: Ingo Molnar 
Cc: David Miller 
Cc: Eric Dumazet 
Acked-by: Mike Frysinger 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

net: Convert struct net_device uc_promisc to bool

2011-07-25T23:17:35+00:00

No need to use int, its uses are boolean.
May save a few bytes one day.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

net: allow netif_carrier to be called safely from IRQ

2011-07-23T00:01:14+00:00

As reported by Ben Greer and Froncois Romieu. The code path in
the netif_carrier code leads it to try and disable
a late workqueue to reenable it immediately
netif_carrier_on
-> linkwatch_fire_event
   -> linkwatch_schedule_work
      -> cancel_delayed_work
         -> del_timer_sync

If __cancel_delayed_work is used instead then there is no
problem of waiting for running linkwatch_event.

There is a race between linkwatch_event running re-scheduling
but it is harmless to schedule an extra scan of the linkwatch queue.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller