linux.git/net/l2tp, branch v3.6-rc4

l2tp: fix info leak via getsockname()

2012-08-16T04:36:31+00:00

The L2TP code for IPv6 fails to initialize the l2tp_unused member of
struct sockaddr_l2tpip6 and that for leaks two bytes kernel stack via
the getsockname() syscall. Initialize l2tp_unused with 0 to avoid the
info leak.

Signed-off-by: Mathias Krause 
Cc: James Chapman 
Signed-off-by: David S. Miller

net: l2tp_eth: provide tx_dropped counter

2012-06-29T07:52:32+00:00

Change l2tp_xmit_skb() to return NET_XMIT_DROP in case skb is dropped.

Use kfree_skb() instead dev_kfree_skb() for drop_monitor pleasure.

Support tx_dropped counter for l2tp_eth

Signed-off-by: Eric Dumazet 
Cc: James Chapman 
Signed-off-by: David S. Miller

net: Use NLMSG_DEFAULT_SIZE in combination with nlmsg_new()

2012-06-29T00:56:43+00:00

Using NLMSG_GOODSIZE results in multiple pages being used as
nlmsg_new() will automatically add the size of the netlink
header to the payload thus exceeding the page limit.

NLMSG_DEFAULT_SIZE takes this into account.

Signed-off-by: Thomas Graf 
Cc: Jiri Pirko 
Cc: Dmitry Eremin-Solenikov 
Cc: Sergey Lapin 
Cc: Johannes Berg 
Cc: Lauro Ramos Venancio 
Cc: Aloisio Almeida Jr 
Cc: Samuel Ortiz 
Reviewed-by: Jiri Pirko 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-06-29T00:37:00+00:00

Conflicts:
	drivers/net/caif/caif_hsi.c
	drivers/net/usb/qmi_wwan.c

The qmi_wwan merge was trivial.

The caif_hsi.c, on the other hand, was not.  It's a conflict between
1c385f1fdf6f9c66d982802cd74349c040980b50 ("caif-hsi: Replace platform
device with ops structure.") in the net-next tree and commit
39abbaef19cd0a30be93794aa4773c779c3eb1f3 ("caif-hsi: Postpone init of
HIS until open()") in the net tree.

I did my best with that one and will ask Sjur to check it out.

Signed-off-by: David S. Miller

net: l2tp_eth: use LLTX to avoid LOCKDEP splats

2012-06-26T23:42:33+00:00

Denys Fedoryshchenko reported a LOCKDEP issue with l2tp code.

[ 8683.927442] ======================================================
[ 8683.927555] [ INFO: possible circular locking dependency detected ]
[ 8683.927672] 3.4.1-build-0061 #14 Not tainted
[ 8683.927782] -------------------------------------------------------
[ 8683.927895] swapper/0/0 is trying to acquire lock:
[ 8683.928007]  (slock-AF_INET){+.-...}, at: []
l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]
[ 8683.928121] but task is already holding lock:
[ 8683.928121]  (_xmit_ETHER#2){+.-...}, at: []
sch_direct_xmit+0x36/0x119
[ 8683.928121]
[ 8683.928121] which lock already depends on the new lock.
[ 8683.928121]
[ 8683.928121]
[ 8683.928121] the existing dependency chain (in reverse order) is:
[ 8683.928121]
[ 8683.928121] -> #1 (_xmit_ETHER#2){+.-...}:
[ 8683.928121]        [] lock_acquire+0x71/0x85
[ 8683.928121]        [] _raw_spin_lock+0x33/0x40
[ 8683.928121]        [] ip_send_reply+0xf2/0x1ce
[ 8683.928121]        [] tcp_v4_send_reset+0x153/0x16f
[ 8683.928121]        [] tcp_v4_do_rcv+0x172/0x194
[ 8683.928121]        [] tcp_v4_rcv+0x387/0x5a0
[ 8683.928121]        [] ip_local_deliver_finish+0x13a/0x1e9
[ 8683.928121]        [] NF_HOOK.clone.11+0x46/0x4d
[ 8683.928121]        [] ip_local_deliver+0x41/0x45
[ 8683.928121]        [] ip_rcv_finish+0x31a/0x33c
[ 8683.928121]        [] NF_HOOK.clone.11+0x46/0x4d
[ 8683.928121]        [] ip_rcv+0x201/0x23d
[ 8683.928121]        [] __netif_receive_skb+0x329/0x378
[ 8683.928121]        [] netif_receive_skb+0x4e/0x7d
[ 8683.928121]        [] rtl8139_poll+0x243/0x33d [8139too]
[ 8683.928121]        [] net_rx_action+0x90/0x15d
[ 8683.928121]        [] __do_softirq+0x7b/0x118
[ 8683.928121]
[ 8683.928121] -> #0 (slock-AF_INET){+.-...}:
[ 8683.928121]        [] __lock_acquire+0x9a3/0xc27
[ 8683.928121]        [] lock_acquire+0x71/0x85
[ 8683.928121]        [] _raw_spin_lock+0x33/0x40
[ 8683.928121]        [] l2tp_xmit_skb+0x173/0x47e
[l2tp_core]
[ 8683.928121]        [] l2tp_eth_dev_xmit+0x1a/0x2f
[l2tp_eth]
[ 8683.928121]        [] dev_hard_start_xmit+0x333/0x3f2
[ 8683.928121]        [] sch_direct_xmit+0x55/0x119
[ 8683.928121]        [] dev_queue_xmit+0x282/0x418
[ 8683.928121]        [] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]        [] arp_xmit+0x22/0x24
[ 8683.928121]        [] arp_send+0x41/0x48
[ 8683.928121]        [] arp_process+0x289/0x491
[ 8683.928121]        [] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]        [] arp_rcv+0xb1/0xc3
[ 8683.928121]        [] __netif_receive_skb+0x329/0x378
[ 8683.928121]        [] process_backlog+0x69/0x130
[ 8683.928121]        [] net_rx_action+0x90/0x15d
[ 8683.928121]        [] __do_softirq+0x7b/0x118
[ 8683.928121]
[ 8683.928121] other info that might help us debug this:
[ 8683.928121]
[ 8683.928121]  Possible unsafe locking scenario:
[ 8683.928121]
[ 8683.928121]        CPU0                    CPU1
[ 8683.928121]        ----                    ----
[ 8683.928121]   lock(_xmit_ETHER#2);
[ 8683.928121]                                lock(slock-AF_INET);
[ 8683.928121]                                lock(_xmit_ETHER#2);
[ 8683.928121]   lock(slock-AF_INET);
[ 8683.928121]
[ 8683.928121]  *** DEADLOCK ***
[ 8683.928121]
[ 8683.928121] 3 locks held by swapper/0/0:
[ 8683.928121]  #0:  (rcu_read_lock){.+.+..}, at: []
rcu_lock_acquire+0x0/0x30
[ 8683.928121]  #1:  (rcu_read_lock_bh){.+....}, at: []
rcu_lock_acquire+0x0/0x30
[ 8683.928121]  #2:  (_xmit_ETHER#2){+.-...}, at: []
sch_direct_xmit+0x36/0x119
[ 8683.928121]
[ 8683.928121] stack backtrace:
[ 8683.928121] Pid: 0, comm: swapper/0 Not tainted 3.4.1-build-0061 #14
[ 8683.928121] Call Trace:
[ 8683.928121]  [] ? printk+0x18/0x1a
[ 8683.928121]  [] print_circular_bug+0x1ac/0x1b6
[ 8683.928121]  [] __lock_acquire+0x9a3/0xc27
[ 8683.928121]  [] lock_acquire+0x71/0x85
[ 8683.928121]  [] ? l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]  [] _raw_spin_lock+0x33/0x40
[ 8683.928121]  [] ? l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]  [] l2tp_xmit_skb+0x173/0x47e [l2tp_core]
[ 8683.928121]  [] l2tp_eth_dev_xmit+0x1a/0x2f [l2tp_eth]
[ 8683.928121]  [] dev_hard_start_xmit+0x333/0x3f2
[ 8683.928121]  [] sch_direct_xmit+0x55/0x119
[ 8683.928121]  [] dev_queue_xmit+0x282/0x418
[ 8683.928121]  [] ? dev_hard_start_xmit+0x3f2/0x3f2
[ 8683.928121]  [] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]  [] arp_xmit+0x22/0x24
[ 8683.928121]  [] ? dev_hard_start_xmit+0x3f2/0x3f2
[ 8683.928121]  [] arp_send+0x41/0x48
[ 8683.928121]  [] arp_process+0x289/0x491
[ 8683.928121]  [] ? __neigh_lookup.clone.20+0x42/0x42
[ 8683.928121]  [] NF_HOOK.clone.19+0x45/0x4c
[ 8683.928121]  [] arp_rcv+0xb1/0xc3
[ 8683.928121]  [] ? __neigh_lookup.clone.20+0x42/0x42
[ 8683.928121]  [] __netif_receive_skb+0x329/0x378
[ 8683.928121]  [] process_backlog+0x69/0x130
[ 8683.928121]  [] net_rx_action+0x90/0x15d
[ 8683.928121]  [] __do_softirq+0x7b/0x118
[ 8683.928121]  [] ? local_bh_enable+0xd/0xd
[ 8683.928121]    [] ? irq_exit+0x41/0x91
[ 8683.928121]  [] ? do_IRQ+0x79/0x8d
[ 8683.928121]  [] ? trace_hardirqs_off_caller+0x2e/0x86
[ 8683.928121]  [] ? common_interrupt+0x2e/0x34
[ 8683.928121]  [] ? default_idle+0x23/0x38
[ 8683.928121]  [] ? cpu_idle+0x55/0x6f
[ 8683.928121]  [] ? rest_init+0xa1/0xa7
[ 8683.928121]  [] ? __read_lock_failed+0x14/0x14
[ 8683.928121]  [] ? start_kernel+0x303/0x30a
[ 8683.928121]  [] ? repair_env_string+0x51/0x51
[ 8683.928121]  [] ? i386_start_kernel+0xa8/0xaf

It appears that like most virtual devices, l2tp should be converted to
LLTX mode.

This patch takes care of statistics using atomic_long in both RX and TX
paths, and fix a bug in l2tp_eth_dev_recv(), which was caching skb->data
before a pskb_may_pull() call.

Signed-off-by: Eric Dumazet 
Reported-by: Denys Fedoryshchenko 
Cc: James Chapman 
Cc: Hong zhi guo 
Cc: Francois Romieu 
Signed-off-by: David S. Miller

net: l2tp_eth: fix l2tp_eth_dev_xmit race

2012-06-25T23:30:54+00:00

Its illegal to dereference skb after giving it to l2tp_xmit_skb()
as it might be already freed/reused.

Signed-off-by: Eric Dumazet 
Cc: James Chapman 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-06-13T04:59:18+00:00

Conflicts:
	MAINTAINERS
	drivers/net/wireless/iwlwifi/pcie/trans.c

The iwlwifi conflict was resolved by keeping the code added
in 'net' that turns off the buggy chip feature.

The MAINTAINERS conflict was merely overlapping changes, one
change updated all the wireless web site URLs and the other
changed some GIT trees to be Johannes's instead of John's.

Signed-off-by: David S. Miller

l2tp: fix a race in l2tp_ip_sendmsg()

2012-06-08T21:30:51+00:00

Commit 081b1b1bb27f (l2tp: fix l2tp_ip_sendmsg() route handling) added
a race, in case IP route cache is disabled.

In this case, we should not do the dst_release(&rt->dst), since it'll
free the dst immediately, instead of waiting a RCU grace period.

Signed-off-by: Eric Dumazet 
Cc: James Chapman 
Cc: Denys Fedoryshchenko 
Signed-off-by: David S. Miller

net: l2tp_eth: fix kernel panic on rmmod l2tp_eth

2012-06-07T20:02:20+00:00

We must prevent module unloading if some devices are still attached to
l2tp_eth driver.

Signed-off-by: Eric Dumazet 
Reported-by: Denys Fedoryshchenko 
Tested-by: Denys Fedoryshchenko 
Cc: James Chapman 
Signed-off-by: David S. Miller

net: Remove casts to same type

2012-06-04T15:45:11+00:00

Adding casts of objects to the same type is unnecessary
and confusing for a human reader.

For example, this cast:

	int y;
	int *p = (int *)&y;

I used the coccinelle script below to find and remove these
unnecessary casts.  I manually removed the conversions this
script produces of casts with __force and __user.

@@
type T;
T *p;
@@

-	(T *)p
+	p

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller