linux.git/net/ipv4, branch v3.13-rc5

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

2013-12-17T20:06:20+00:00

Pablo Neira Ayuso says:

====================
The following patchset contains two Netfilter fixes for your net
tree, they are:

* Fix endianness in nft_reject, the NFTA_REJECT_TYPE netlink attributes
  was not converted to network byte order as needed by all nfnetlink
  subsystems, from Eric Leblond.

* Restrict SYNPROXY target to INPUT and FORWARD chains, this avoid a
  possible crash due to misconfigurations, from Patrick McHardy.
====================

Signed-off-by: David S. Miller

udp: ipv4: do not use sk_dst_lock from softirq context

2013-12-17T19:50:58+00:00

Using sk_dst_lock from softirq context is not supported right now.

Instead of adding BH protection everywhere,
udp_sk_rx_dst_set() can instead use xchg(), as suggested
by David.

Reported-by: Fengguang Wu 
Fixes: 975022310233 ("udp: ipv4: must add synchronization in udp_sk_rx_dst_set()")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

netfilter: nft_reject: fix endianness in dump function

2013-12-12T08:37:39+00:00

The dump function in nft_reject_ipv4 was not converting a u32
field to network order before sending it to userspace, this
needs to happen for consistency with other nf_tables and
nfnetlink subsystems.

Signed-off-by: Eric Leblond 
Signed-off-by: Pablo Neira Ayuso

udp: ipv4: must add synchronization in udp_sk_rx_dst_set()

2013-12-12T01:21:10+00:00

Unlike TCP, UDP input path does not hold the socket lock.

Before messing with sk->sk_rx_dst, we must use a spinlock, otherwise
multiple cpus could leak a refcount.

This patch also takes care of renewing a stale dst entry.
(When the sk->sk_rx_dst would not be used by IP early demux)

Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux")
Signed-off-by: Eric Dumazet 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller

udp: ipv4: fix potential use after free in udp_v4_early_demux()

2013-12-11T21:10:14+00:00

pskb_may_pull() can reallocate skb->head, we need to move the
initialization of iph and uh pointers after its call.

Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux")
Signed-off-by: Eric Dumazet 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller

netfilter: SYNPROXY target: restrict to INPUT/FORWARD

2013-12-11T10:30:25+00:00

Fix a crash in synproxy_send_tcp() when using the SYNPROXY target in the
PREROUTING chain caused by missing routing information.

Reported-by: Nicki P. 
Signed-off-by: Patrick McHardy 
Signed-off-by: Pablo Neira Ayuso

udp: ipv4: fix an use after free in __udp4_lib_rcv()

2013-12-11T03:58:40+00:00

Dave Jones reported a use after free in UDP stack :

[ 5059.434216] =========================
[ 5059.434314] [ BUG: held lock freed! ]
[ 5059.434420] 3.13.0-rc3+ #9 Not tainted
[ 5059.434520] -------------------------
[ 5059.434620] named/863 is freeing memory ffff88005e960000-ffff88005e96061f, with a lock still held there!
[ 5059.434815]  (slock-AF_INET){+.-...}, at: [] udp_queue_rcv_skb+0xd1/0x4b0
[ 5059.435012] 3 locks held by named/863:
[ 5059.435086]  #0:  (rcu_read_lock){.+.+..}, at: [] __netif_receive_skb_core+0x11d/0x940
[ 5059.435295]  #1:  (rcu_read_lock){.+.+..}, at: [] ip_local_deliver_finish+0x3e/0x410
[ 5059.435500]  #2:  (slock-AF_INET){+.-...}, at: [] udp_queue_rcv_skb+0xd1/0x4b0
[ 5059.435734]
stack backtrace:
[ 5059.435858] CPU: 0 PID: 863 Comm: named Not tainted 3.13.0-rc3+ #9 [loadavg: 0.21 0.06 0.06 1/115 1365]
[ 5059.436052] Hardware name:                  /D510MO, BIOS MOPNV10J.86A.0175.2010.0308.0620 03/08/2010
[ 5059.436223]  0000000000000002 ffff88007e203ad8 ffffffff8153a372 ffff8800677130e0
[ 5059.436390]  ffff88007e203b10 ffffffff8108cafa ffff88005e960000 ffff88007b00cfc0
[ 5059.436554]  ffffea00017a5800 ffffffff8141c490 0000000000000246 ffff88007e203b48
[ 5059.436718] Call Trace:
[ 5059.436769]    [] dump_stack+0x4d/0x66
[ 5059.436904]  [] debug_check_no_locks_freed+0x15a/0x160
[ 5059.437037]  [] ? __sk_free+0x110/0x230
[ 5059.437147]  [] kmem_cache_free+0x6a/0x150
[ 5059.437260]  [] __sk_free+0x110/0x230
[ 5059.437364]  [] sk_free+0x19/0x20
[ 5059.437463]  [] sock_edemux+0x25/0x40
[ 5059.437567]  [] sock_queue_rcv_skb+0x81/0x280
[ 5059.437685]  [] ? udp_queue_rcv_skb+0xd1/0x4b0
[ 5059.437805]  [] __udp_queue_rcv_skb+0x42/0x240
[ 5059.437925]  [] ? _raw_spin_lock+0x65/0x70
[ 5059.438038]  [] udp_queue_rcv_skb+0x26b/0x4b0
[ 5059.438155]  [] __udp4_lib_rcv+0x152/0xb00
[ 5059.438269]  [] udp_rcv+0x15/0x20
[ 5059.438367]  [] ip_local_deliver_finish+0x10f/0x410
[ 5059.438492]  [] ? ip_local_deliver_finish+0x3e/0x410
[ 5059.438621]  [] ip_local_deliver+0x43/0x80
[ 5059.438733]  [] ip_rcv_finish+0x140/0x5a0
[ 5059.438843]  [] ip_rcv+0x296/0x3f0
[ 5059.438945]  [] __netif_receive_skb_core+0x742/0x940
[ 5059.439074]  [] ? __netif_receive_skb_core+0x11d/0x940
[ 5059.442231]  [] ? trace_hardirqs_on+0xd/0x10
[ 5059.442231]  [] __netif_receive_skb+0x13/0x60
[ 5059.442231]  [] netif_receive_skb+0x1e/0x1f0
[ 5059.442231]  [] napi_gro_receive+0x70/0xa0
[ 5059.442231]  [] rtl8169_poll+0x166/0x700 [r8169]
[ 5059.442231]  [] net_rx_action+0x129/0x1e0
[ 5059.442231]  [] __do_softirq+0xed/0x240
[ 5059.442231]  [] irq_exit+0x125/0x140
[ 5059.442231]  [] do_IRQ+0x51/0xc0
[ 5059.442231]  [] common_interrupt+0x6f/0x6f

We need to keep a reference on the socket, by using skb_steal_sock()
at the right place.

Note that another patch is needed to fix a race in
udp_sk_rx_dst_set(), as we hold no lock protecting the dst.

Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux")
Reported-by: Dave Jones 
Signed-off-by: Eric Dumazet 
Cc: Shawn Bohrer 
Signed-off-by: David S. Miller

inet: fix NULL pointer Oops in fib(6)_rule_suppress

2013-12-10T22:54:23+00:00

This changes ensures that the routing entry investigated by the suppress
function actually does point to a device struct before following that pointer,
fixing a possible kernel oops situation when verifying the interface group
associated with a routing table entry.

According to Daniel Golle, this Oops can be triggered by a user process trying
to establish an outgoing IPv6 connection while having no real IPv6 connectivity
set up (only autoassigned link-local addresses).

Fixes: 6ef94cfafba15 ("fib_rules: add route suppression based on ifgroup")

Reported-by: Daniel Golle 
Tested-by: Daniel Golle 
Signed-off-by: Stefan Tomanek 
Signed-off-by: David S. Miller

tcp_memcontrol: Cleanup/fix cg_proto->memory_pressure handling.

2013-12-06T02:01:01+00:00

kill memcg_tcp_enter_memory_pressure.  The only function of
memcg_tcp_enter_memory_pressure was to reduce deal with the
unnecessary abstraction that was tcp_memcontrol.  Now that struct
tcp_memcontrol is gone remove this unnecessary function, the
unnecessary function pointer, and modify sk_enter_memory_pressure to
set this field directly, just as sk_leave_memory_pressure cleas this
field directly.

This fixes a small bug I intruduced when killing struct tcp_memcontrol
that caused memcg_tcp_enter_memory_pressure to never be called and
thus failed to ever set cg_proto->memory_pressure.

Remove the cg_proto enter_memory_pressure function as it now serves
no useful purpose.

Don't test cg_proto->memory_presser in sk_leave_memory_pressure before
clearing it.  The test was originally there to ensure that the pointer
was non-NULL.  Now that cg_proto is not a pointer the pointer does not
matter.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-12-02T18:09:07+00:00

Pull networking updates from David Miller:
 "Here is a pile of bug fixes that accumulated while I was in Europe"

 1) In fixing kernel leaks to userspace during copying of socket
    addresses, we broke a case that used to work, namely the user
    providing a buffer larger than the in-kernel generic socket address
    structure.  This broke Ruby amongst other things.  Fix from Dan
    Carpenter.

 2) Fix regression added by byte queue limit support in 8139cp driver,
    from Yang Yingliang.

 3) The addition of MSG_SENDPAGE_NOTLAST buggered up a few sendpage
    implementations, they should just treat it the same as MSG_MORE.
    Fix from Richard Weinberger and Shawn Landden.

 4) Handle icmpv4 errors received on ipv6 SIT tunnels correctly, from
    Oussama Ghorbel.  In particular we should send an ICMPv6 unreachable
    in such situations.

 5) Fix some regressions in the recent genetlink fixes, in particular
    get the pmcraid driver to use the new safer interfaces correctly.
    From Johannes Berg.

 6) macvtap was converted to use a per-cpu set of statistics, but some
    code was still bumping tx_dropped elsewhere.  From Jason Wang.

 7) Fix build failure of xen-netback due to missing include on some
    architectures, from Andy Whitecroft.

 8) macvtap double counts received packets in statistics, fix from Vlad
    Yasevich.

 9) Fix various cases of using *_STATS_BH() when *_STATS() is more
    appropriate.  From Eric Dumazet and Hannes Frederic Sowa.

10) Pktgen ipsec mode doesn't update the ipv4 header length and checksum
    properly after encapsulation.  Fix from Fan Du.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits)
  net/mlx4_en: Remove selftest TX queues empty condition
  {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation
  virtio_net: make all RX paths handle erors consistently
  virtio_net: fix error handling for mergeable buffers
  virtio_net: Fixed a trivial typo (fitler --> filter)
  netem: fix gemodel loss generator
  netem: fix loss 4 state model
  netem: missing break in ge loss generator
  net/hsr: Support iproute print_opt ('ip -details ...')
  net/hsr: Very small fix of comment style.
  MAINTAINERS: Added net/hsr/ maintainer
  ipv6: fix possible seqlock deadlock in ip6_finish_output2
  ixgbe: Make ixgbe_identify_qsfp_module_generic static
  ixgbe: turn NETIF_F_HW_L2FW_DOFFLOAD off by default
  ixgbe: ixgbe_fwd_ring_down needs to be static
  e1000: fix possible reset_task running after adapter down
  e1000: fix lockdep warning in e1000_reset_task
  e1000: prevent oops when adapter is being closed and reset simultaneously
  igb: Fixed Wake On LAN support
  inet: fix possible seqlock deadlocks
  ...