linux.git/net/core, branch v3.4-rc6

drop_monitor: prevent init path from scheduling on the wrong cpu

2012-05-03T01:02:48+00:00

I just noticed after some recent updates, that the init path for the drop
monitor protocol has a minor error.  drop monitor maintains a per cpu structure,
that gets initalized from a single cpu.  Normally this is fine, as the protocol
isn't in use yet, but I recently made a change that causes a failed skb
allocation to reschedule itself .  Given the current code, the implication is
that this workqueue reschedule will take place on the wrong cpu.  If drop
monitor is used early during the boot process, its possible that two cpus will
access a single per-cpu structure in parallel, possibly leading to data
corruption.

This patch fixes the situation, by storing the cpu number that a given instance
of this per-cpu data should be accessed from.  In the case of a need for a
reschedule, the cpu stored in the struct is assigned the rescheule, rather than
the currently executing cpu

Tested successfully by myself.

Signed-off-by: Neil Horman 
CC: David Miller 
Signed-off-by: David S. Miller

drop_monitor: Make updating data->skb smp safe

2012-04-28T06:18:48+00:00

Eric Dumazet pointed out to me that the drop_monitor protocol has some holes in
its smp protections.  Specifically, its possible to replace data->skb while its
being written.  This patch corrects that by making data->skb an rcu protected
variable.  That will prevent it from being overwritten while a tracepoint is
modifying it.

Signed-off-by: Neil Horman 
Reported-by: Eric Dumazet 
CC: David Miller 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

drop_monitor: fix sleeping in invalid context warning

2012-04-28T06:18:48+00:00

Eric Dumazet pointed out this warning in the drop_monitor protocol to me:

[   38.352571] BUG: sleeping function called from invalid context at kernel/mutex.c:85
[   38.352576] in_atomic(): 1, irqs_disabled(): 0, pid: 4415, name: dropwatch
[   38.352580] Pid: 4415, comm: dropwatch Not tainted 3.4.0-rc2+ #71
[   38.352582] Call Trace:
[   38.352592]  [] ? trace_napi_poll_hit+0xd0/0xd0
[   38.352599]  [] __might_sleep+0xca/0xf0
[   38.352606]  [] mutex_lock+0x26/0x50
[   38.352610]  [] ? trace_napi_poll_hit+0xd0/0xd0
[   38.352616]  [] tracepoint_probe_register+0x29/0x90
[   38.352621]  [] set_all_monitor_traces+0x105/0x170
[   38.352625]  [] net_dm_cmd_trace+0x2a/0x40
[   38.352630]  [] genl_rcv_msg+0x21a/0x2b0
[   38.352636]  [] ? zone_statistics+0x99/0xc0
[   38.352640]  [] ? genl_rcv+0x30/0x30
[   38.352645]  [] netlink_rcv_skb+0xa9/0xd0
[   38.352649]  [] genl_rcv+0x20/0x30
[   38.352653]  [] netlink_unicast+0x1ae/0x1f0
[   38.352658]  [] netlink_sendmsg+0x2b6/0x310
[   38.352663]  [] sock_sendmsg+0x10f/0x130
[   38.352668]  [] ? move_addr_to_kernel+0x60/0xb0
[   38.352673]  [] ? verify_iovec+0x64/0xe0
[   38.352677]  [] __sys_sendmsg+0x386/0x390
[   38.352682]  [] ? handle_mm_fault+0x139/0x210
[   38.352687]  [] ? do_page_fault+0x1ec/0x4f0
[   38.352693]  [] ? set_next_entity+0x9d/0xb0
[   38.352699]  [] ? tty_ldisc_deref+0x9/0x10
[   38.352703]  [] ? pick_next_task_fair+0x63/0x140
[   38.352708]  [] sys_sendmsg+0x44/0x80
[   38.352713]  [] system_call_fastpath+0x16/0x1b

It stems from holding a spinlock (trace_state_lock) while attempting to register
or unregister tracepoint hooks, making in_atomic() true in this context, leading
to the warning when the tracepoint calls might_sleep() while its taking a mutex.
Since we only use the trace_state_lock to prevent trace protocol state races, as
well as hardware stat list updates on an rcu write side, we can just convert the
spinlock to a mutex to avoid this problem.

Signed-off-by: Neil Horman 
Reported-by: Eric Dumazet 
CC: David Miller 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

drop_monitor: allow more events per second

2012-04-21T20:28:38+00:00

It seems there is a logic error in trace_drop_common(), since we store
only 64 drops, even if they are from same location.

This fix is a one liner, but we probably need more work to avoid useless
atomic dec/inc

Now I can watch 1 Mpps drops through dropwatch...

Signed-off-by: Eric Dumazet 
Cc: Neil Horman 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller

netns: do not leak net_generic data on failed init

2012-04-18T04:05:33+00:00

ops_init should free the net_generic data on
init failure and __register_pernet_operations should not
call ops_free when NET_NS is not enabled.

Signed-off-by: Julian Anastasov 
Reviewed-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: In unregister_netdevice_notifier unregister the netdevices.

2012-04-13T15:01:43+00:00

We already synthesize events in register_netdevice_notifier and synthesizing
events in unregister_netdevice_notifier allows to us remove the need for
special case cleanup code.

This change should be safe as it adds no new cases for existing callers
of unregiser_netdevice_notifier to handle.

Signed-off-by: Eric W. Biederman 
Signed-off-by: David S. Miller

net: allow pskb_expand_head() to get maximum tailroom

2012-04-11T14:10:43+00:00

Marc Merlin reported many order-1 allocations failures in TX path on its
wireless setup, that dont make any sense with MTU=1500 network, and non
SG capable hardware.

Turns out part of the problem comes from pskb_expand_head() not using
ksize() to get exact head size given by kmalloc(). Doing the same thing
than __alloc_skb() allows more tailroom in skb and can prevent future
reallocations.

As a bonus, struct skb_shared_info becomes cache line aligned.

Reported-by: Marc MERLIN 
Tested-by: Marc MERLIN 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: fix a race in sock_queue_err_skb()

2012-04-06T09:07:21+00:00

As soon as an skb is queued into socket error queue, another thread
can consume it, so we are not allowed to reference skb anymore, or risk
use after free.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

bpf jit: Make the filter.c::__load_pointer helper non-static for the jits

2012-04-03T22:01:03+00:00

The function is renamed to make it a little more clear what it does.
It is not added to any .h because it is not for general consumption, only for
bpf internal use (and so by the jits).

Signed-of-by: Jan Seiffert 
Acked-by: Eric Dumazet 

Signed-off-by: David S. Miller

net: fix /proc/net/dev regression

2012-04-03T21:23:23+00:00

Commit f04565ddf52 (dev: use name hash for dev_seq_ops) added a second
regression, as some devices are missing from /proc/net/dev if many
devices are defined.

When seq_file buffer is filled, the last ->next/show() method is
canceled (pos value is reverted to value prior ->next() call)

Problem is after above commit, we dont restart the lookup at right
position in ->start() method.

Fix this by removing the internal 'pos' pointer added in commit, since
we need to use the 'loff_t *pos' provided by seq_file layer.

This also reverts commit 5cac98dd0 (net: Fix corruption
in /proc/*/net/dev_mcast), since its not needed anymore.

Reported-by: Ben Greear 
Signed-off-by: Eric Dumazet 
Cc: Mihai Maruseac 
Tested-by:  Ben Greear 
Signed-off-by: David S. Miller