linux.git/net/core, branch v3.1-rc9

fib:fix BUG_ON in fib_nl_newrule when add new fib rule

2011-09-21T19:16:40+00:00

add new fib rule can cause BUG_ON happen
the reproduce shell is
ip rule add pref 38
ip rule add pref 38
ip rule add to 192.168.3.0/24 goto 38
ip rule del pref 38
ip rule add to 192.168.3.0/24 goto 38
ip rule add pref 38

then the BUG_ON will happen
del BUG_ON and use (ctarget == NULL) identify whether this rule is unresolved

Signed-off-by: Gao feng 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: Handle different key sizes between address families in flow cache

2011-09-16T21:47:28+00:00

With the conversion of struct flowi to a union of AF-specific structs, some
operations on the flow cache need to account for the exact size of the key.

Signed-off-by: David Ward 
Signed-off-by: David S. Miller

net: copy userspace buffers on device forwarding

2011-09-15T18:49:44+00:00

dev_forward_skb loops an skb back into host networking
stack which might hang on the memory indefinitely.
In particular, this can happen in macvtap in bridged mode.
Copy the userspace fragments to avoid blocking the
sender in that case.

As this patch makes skb_copy_ubufs extern now,
I also added some documentation and made it clear
the SKBTX_DEV_ZEROCOPY flag automatically instead
of doing it in all callers. This can be made into a separate
patch if people feel it's worth it.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

net: Make flow cache namespace-aware

2011-09-15T18:49:44+00:00

flow_cache_lookup will return a cached object (or null pointer) that the
resolver (i.e. xfrm_policy_lookup) previously found for another namespace
using the same key/family/dir.  Instead, make the namespace part of what
identifies entries in the cache.

As before, flow_entry_valid will return 0 for entries where the namespace
has been deleted, and they will be removed from the cache the next time
flow_cache_gc_task is run.

Reported-by: Andrew Dickinson 
Signed-off-by: David Ward 
Signed-off-by: David S. Miller

netpoll: fix incorrect access to skb data in __netpoll_rx

2011-08-26T16:49:04+00:00

__netpoll_rx() doesnt properly handle skbs with small header

pskb_may_pull() or pskb_trim_rcsum() can change skb->data, we must
reload it.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

arp: fix rcu lockdep splat in arp_process()

2011-08-25T00:55:00+00:00

Dave Jones reported a lockdep splat triggered by an arp_process() call
from parp_redo().

Commit faa9dcf793be (arp: RCU changes) is the origin of the bug, since
it assumed arp_process() was called under rcu_read_lock(), which is not
true in this particular path.

Instead of adding rcu_read_lock() in parp_redo(), I chose to add it in
neigh_proxy_process() to take care of IPv6 side too.

 ===================================================
 [ INFO: suspicious rcu_dereference_check() usage. ]
 ---------------------------------------------------
 include/linux/inetdevice.h:209 invoked rcu_dereference_check() without
protection!

 other info that might help us debug this:

 rcu_scheduler_active = 1, debug_locks = 0
 4 locks held by setfiles/2123:
  #0:  (&sb->s_type->i_mutex_key#13){+.+.+.}, at: []
walk_component+0x1ef/0x3e8
  #1:  (&isec->lock){+.+.+.}, at: []
inode_doinit_with_dentry+0x3f/0x41f
  #2:  (&tbl->proxy_timer){+.-...}, at: []
run_timer_softirq+0x157/0x372
  #3:  (class){+.-...}, at: [] neigh_proxy_process
+0x36/0x103

 stack backtrace:
 Pid: 2123, comm: setfiles Tainted: G        W
3.1.0-0.rc2.git7.2.fc16.x86_64 #1
 Call Trace:
    [] lockdep_rcu_dereference+0xa7/0xaf
  [] __in_dev_get_rcu+0x55/0x5d
  [] arp_process+0x25/0x4d7
  [] parp_redo+0xe/0x10
  [] neigh_proxy_process+0x9a/0x103
  [] run_timer_softirq+0x218/0x372
  [] ? run_timer_softirq+0x157/0x372
  [] ? neigh_stat_seq_open+0x41/0x41
  [] ? mark_held_locks+0x6d/0x95
  [] __do_softirq+0x112/0x25a
  [] call_softirq+0x1c/0x30
  [] do_softirq+0x4b/0xa2
  [] irq_exit+0x5d/0xcf
  [] smp_apic_timer_interrupt+0x7c/0x8a
  [] apic_timer_interrupt+0x73/0x80
    [] ? trace_hardirqs_on_caller+0x121/0x158
  [] ? __slab_free+0x30/0x24c
  [] ? __slab_free+0x2e/0x24c
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] ? inode_doinit_with_dentry+0x2e9/0x41f
  [] kfree+0x108/0x131
  [] inode_doinit_with_dentry+0x2e9/0x41f
  [] selinux_d_instantiate+0x1c/0x1e
  [] security_d_instantiate+0x21/0x23
  [] d_instantiate+0x5c/0x61
  [] d_splice_alias+0xbc/0xd2
  [] ext4_lookup+0xba/0xeb
  [] d_alloc_and_lookup+0x45/0x6b
  [] walk_component+0x215/0x3e8
  [] lookup_last+0x3b/0x3d
  [] path_lookupat+0x82/0x2af
  [] ? might_fault+0xa5/0xac
  [] ? might_fault+0x5c/0xac
  [] ? getname_flags+0x31/0x1ca
  [] do_path_lookup+0x28/0x97
  [] user_path_at+0x59/0x96
  [] ? cp_new_stat+0xf7/0x10d
  [] vfs_fstatat+0x44/0x6e
  [] vfs_lstat+0x1e/0x20
  [] sys_newlstat+0x1a/0x33
  [] ? trace_hardirqs_on_caller+0x121/0x158
  [] ? trace_hardirqs_on_thunk+0x3a/0x3f
  [] system_call_fastpath+0x16/0x1b

Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

scm: Capture the full credentials of the scm sender

2011-08-11T12:52:57+00:00

This patch corrects an erroneous update of credential's gid with uid
introduced in commit 257b5358b32f17 since 2.6.36.

Signed-off-by: Tim Chen 
Acked-by: Eric Dumazet 
Reviewed-by: James Morris 
Signed-off-by: David S. Miller

net: Compute protocol sequence numbers and fragment IDs using MD5.

2011-08-07T01:33:19+00:00

Computers have become a lot faster since we compromised on the
partial MD4 hash which we use currently for performance reasons.

MD5 is a much safer choice, and is inline with both RFC1948 and
other ISS generators (OpenBSD, Solaris, etc.)

Furthermore, only having 24-bits of the sequence number be truly
unpredictable is a very serious limitation.  So the periodic
regeneration and 8-bit counter have been removed.  We compute and
use a full 32-bit sequence number.

For ipv6, DCCP was found to use a 32-bit truncated initial sequence
number (it needs 43-bits) and that is fixed here as well.

Reported-by: Dan Kaminsky 
Tested-by: Willy Tarreau 
Signed-off-by: David S. Miller

net: add kerneldoc to skb_copy_bits()

2011-08-02T01:03:06+00:00

Since skb_copy_bits() is called from assembly, add a fat comment to make
clear we should think twice before changing its prototype.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2011-07-28T12:58:19+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (32 commits)
  tg3: Remove 5719 jumbo frames and TSO blocks
  tg3: Break larger frags into 4k chunks for 5719
  tg3: Add tx BD budgeting code
  tg3: Consolidate code that calls tg3_tx_set_bd()
  tg3: Add partial fragment unmapping code
  tg3: Generalize tg3_skb_error_unmap()
  tg3: Remove short DMA check for 1st fragment
  tg3: Simplify tx bd assignments
  tg3: Reintroduce tg3_tx_ring_info
  ASIX: Use only 11 bits of header for data size
  ASIX: Simplify condition in rx_fixup()
  Fix cdc-phonet build
  bonding: reduce noise during init
  bonding: fix string comparison errors
  net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared
  net: add IFF_SKB_TX_SHARED flag to priv_flags
  net: sock_sendmsg_nosec() is static
  forcedeth: fix vlans
  gianfar: fix bug caused by 87c288c6e9aa31720b72e2bc2d665e24e1653c3e
  gro: Only reset frag0 when skb can be pulled
  ...