Eric Lee / smarc-fsl-linux-kernel

09 May, 2019

1 commit

06 May, 2019

1 commit

  • 1ffad6d1a   Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next ... Browse Code »

    Pablo Neira Ayuso says:

    ===================
    Netfilter updates for net-next

    The following batch contains Netfilter updates for net-next, they are:

    1) Move nft_expr_clone() to nft_dynset, from Paul Gortmaker.

    2) Do not include module.h from net/netfilter/nf_tables.h,
    also from Paul.

    3) Restrict conntrack sysctl entries to boolean, from Tonghao Zhang.

    4) Several patches to add infrastructure to autoload NAT helper
    modules from their respective conntrack helper, this also includes
    the first client of this code in OVS, patches from Flavio Leitner.

    5) Add support to match for conntrack ID, from Brett Mastbergen.

    6) Spelling fix in connlabel, from Colin Ian King.

    7) Use struct_size() from hashlimit, from Gustavo A. R. Silva.

    8) Add optimized version of nf_inet_addr_mask(), from Li RongQing.
    ===================

    Signed-off-by: David S. Miller

    David S. Miller
     

05 May, 2019

1 commit

  • ca9653463   openvswitch: check for null pointer return from nla_nest_start_noflag ... Browse Code »

    The call to nla_nest_start_noflag can return null in the unlikely
    event that nla_put returns -EMSGSIZE. Check for this condition to
    avoid a null pointer dereference on pointer nla_reply.

    Addresses-Coverity: ("Dereference null return value")
    Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
    Signed-off-by: Colin Ian King
    Acked-by: Yi-Hung Wei
    Signed-off-by: David S. Miller

    Colin Ian King
     

04 May, 2019

1 commit

30 Apr, 2019

1 commit

  • fec9c271b   openvswitch: load and reference the NAT helper. ... Browse Code »

    This improves the original commit 17c357efe5ec ("openvswitch: load
    NAT helper") where it unconditionally tries to load the module for
    every flow using NAT, so not efficient when loading multiple flows.
    It also doesn't hold any references to the NAT module while the
    flow is active.

    This change fixes those problems. It will try to load the module
    only if it's not present. It grabs a reference to the NAT module
    and holds it while the flow is active. Finally, an error message
    shows up if either actions above fails.

    Fixes: 17c357efe5ec ("openvswitch: load NAT helper")
    Signed-off-by: Flavio Leitner
    Signed-off-by: Pablo Neira Ayuso

    Flavio Leitner
     

28 Apr, 2019

3 commits

  • ef6243acb   genetlink: optionally validate strictly/dumps ... Browse Code »

    Add options to strictly validate messages and dump messages,
    sometimes perhaps validating dump messages non-strictly may
    be required, so add an option for that as well.

    Since none of this can really be applied to existing commands,
    set the options everwhere using the following spatch:

    @@
    identifier ops;
    expression X;
    @@
    struct genl_ops ops[] = {
    ...,
    {
    .cmd = X,
    + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    ...
    },
    ...
    };

    For new commands one should just not copy the .validate 'opt-out'
    flags and thus get strict validation.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • 8cb081746   netlink: make validation more configurable for future strictness ... Browse Code »

    We currently have two levels of strict validation:

    1) liberal (default)
    - undefined (type >= max) & NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted
    - garbage at end of message accepted
    2) strict (opt-in)
    - NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted

    Split out parsing strictness into four different options:
    * TRAILING - check that there's no trailing data after parsing
    attributes (in message or nested)
    * MAXTYPE - reject attrs > max known type
    * UNSPEC - reject attributes with NLA_UNSPEC policy entries
    * STRICT_ATTRS - strictly validate attribute size

    The default for future things should be *everything*.
    The current *_strict() is a combination of TRAILING and MAXTYPE,
    and is renamed to _deprecated_strict().
    The current regular parsing has none of this, and is renamed to
    *_parse_deprecated().

    Additionally it allows us to selectively set one of the new flags
    even on old policies. Notably, the UNSPEC flag could be useful in
    this case, since it can be arranged (by filling in the policy) to
    not be an incompatible userspace ABI change, but would then going
    forward prevent forgetting attribute entries. Similar can apply
    to the POLICY flag.

    We end up with the following renames:
    * nla_parse -> nla_parse_deprecated
    * nla_parse_strict -> nla_parse_deprecated_strict
    * nlmsg_parse -> nlmsg_parse_deprecated
    * nlmsg_parse_strict -> nlmsg_parse_deprecated_strict
    * nla_parse_nested -> nla_parse_nested_deprecated
    * nla_validate_nested -> nla_validate_nested_deprecated

    Using spatch, of course:
    @@
    expression TB, MAX, HEAD, LEN, POL, EXT;
    @@
    -nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
    +nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression TB, MAX, NLA, POL, EXT;
    @@
    -nla_parse_nested(TB, MAX, NLA, POL, EXT)
    +nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)

    @@
    expression START, MAX, POL, EXT;
    @@
    -nla_validate_nested(START, MAX, POL, EXT)
    +nla_validate_nested_deprecated(START, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, MAX, POL, EXT;
    @@
    -nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
    +nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)

    For this patch, don't actually add the strict, non-renamed versions
    yet so that it breaks compile if I get it wrong.

    Also, while at it, make nla_validate and nla_parse go down to a
    common __nla_validate_parse() function to avoid code duplication.

    Ultimately, this allows us to have very strict validation for every
    new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
    next patch, while existing things will continue to work as is.

    In effect then, this adds fully strict validation for any new command.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • ae0be8de9   netlink: make nla_nest_start() add NLA_F_NESTED flag ... Browse Code »

    Even if the NLA_F_NESTED flag was introduced more than 11 years ago, most
    netlink based interfaces (including recently added ones) are still not
    setting it in kernel generated messages. Without the flag, message parsers
    not aware of attribute semantics (e.g. wireshark dissector or libmnl's
    mnl_nlmsg_fprintf()) cannot recognize nested attributes and won't display
    the structure of their contents.

    Unfortunately we cannot just add the flag everywhere as there may be
    userspace applications which check nlattr::nla_type directly rather than
    through a helper masking out the flags. Therefore the patch renames
    nla_nest_start() to nla_nest_start_noflag() and introduces nla_nest_start()
    as a wrapper adding NLA_F_NESTED. The calls which add NLA_F_NESTED manually
    are rewritten to use nla_nest_start().

    Except for changes in include/net/netlink.h, the patch was generated using
    this semantic patch:

    @@ expression E1, E2; @@
    -nla_nest_start(E1, E2)
    +nla_nest_start_noflag(E1, E2)

    @@ expression E1, E2; @@
    -nla_nest_start_noflag(E1, E2 | NLA_F_NESTED)
    +nla_nest_start(E1, E2)

    Signed-off-by: Michal Kubecek
    Acked-by: Jiri Pirko
    Acked-by: David Ahern
    Signed-off-by: David S. Miller

    Michal Kubecek
     

09 Apr, 2019

1 commit

06 Apr, 2019

1 commit

03 Apr, 2019

1 commit

  • 6d670497e   openvswitch: use after free in __ovs_ct_free_action() ... Browse Code »

    We free "ct_info->ct" and then use it on the next line when we pass it
    to nf_ct_destroy_timeout(). This patch swaps the order to avoid the use
    after free.

    Fixes: 06bd2bdf19d2 ("openvswitch: Add timeout support to ct action")
    Signed-off-by: Dan Carpenter
    Acked-by: Yi-Hung Wei
    Signed-off-by: David S. Miller

    Dan Carpenter
     

30 Mar, 2019

1 commit

  • 18b6f7174   openvswitch: Make metadata_dst tunnel work in IP_TUNNEL_INFO_BRIDGE mode ... Browse Code »

    There is currently no support for the multicast/broadcast aspects
    of VXLAN in ovs. In the datapath flow the tun_dst must specific.
    But in the IP_TUNNEL_INFO_BRIDGE mode the tun_dst can not be specific.
    And the packet can forward through the fdb table of vxlan devcice. In
    this mode the broadcast/multicast packet can be sent through the
    following ways in ovs.

    ovs-vsctl add-port br0 vxlan -- set in vxlan type=vxlan \
    options:key=1000 options:remote_ip=flow
    ovs-ofctl add-flow br0 in_port=LOCAL,dl_dst=ff:ff:ff:ff:ff:ff, \
    action=output:vxlan

    bridge fdb append ff:ff:ff:ff:ff:ff dev vxlan_sys_4789 dst 172.168.0.1 \
    src_vni 1000 vni 1000 self
    bridge fdb append ff:ff:ff:ff:ff:ff dev vxlan_sys_4789 dst 172.168.0.2 \
    src_vni 1000 vni 1000 self

    Signed-off-by: wenxu
    Acked-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    wenxu
     

29 Mar, 2019

2 commits

  • f28cd2af2   openvswitch: fix flow actions reallocation ... Browse Code »

    The flow action buffer can be resized if it's not big enough to contain
    all the requested flow actions. However, this resize doesn't take into
    account the new requested size, the buffer is only increased by a factor
    of 2x. This might be not enough to contain the new data, causing a
    buffer overflow, for example:

    [ 42.044472] =============================================================================
    [ 42.045608] BUG kmalloc-96 (Not tainted): Redzone overwritten
    [ 42.046415] -----------------------------------------------------------------------------

    [ 42.047715] Disabling lock debugging due to kernel taint
    [ 42.047716] INFO: 0x8bf2c4a5-0x720c0928. First byte 0x0 instead of 0xcc
    [ 42.048677] INFO: Slab 0xbc6d2040 objects=29 used=18 fp=0xdc07dec4 flags=0x2808101
    [ 42.049743] INFO: Object 0xd53a3464 @offset=2528 fp=0xccdcdebb

    [ 42.050747] Redzone 76f1b237: cc cc cc cc cc cc cc cc ........
    [ 42.051839] Object d53a3464: 6b 6b 6b 6b 6b 6b 6b 6b 0c 00 00 00 6c 00 00 00 kkkkkkkk....l...
    [ 42.053015] Object f49a30cc: 6c 00 0c 00 00 00 00 00 00 00 00 03 78 a3 15 f6 l...........x...
    [ 42.054203] Object acfe4220: 20 00 02 00 ff ff ff ff 00 00 00 00 00 00 00 00 ...............
    [ 42.055370] Object 21024e91: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    [ 42.056541] Object 070e04c3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    [ 42.057797] Object 948a777a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    [ 42.059061] Redzone 8bf2c4a5: 00 00 00 00 ....
    [ 42.060189] Padding a681b46e: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ

    Fix by making sure the new buffer is properly resized to contain all the
    requested data.

    BugLink: https://bugs.launchpad.net/bugs/1813244
    Signed-off-by: Andrea Righi
    Acked-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    Andrea Righi
     
  • 06bd2bdf1   openvswitch: Add timeout support to ct action ... Browse Code »

    Add support for fine-grain timeout support to conntrack action.
    The new OVS_CT_ATTR_TIMEOUT attribute of the conntrack action
    specifies a timeout to be associated with this connection.
    If no timeout is specified, it acts as is, that is the default
    timeout for the connection will be automatically applied.

    Example usage:
    $ nfct timeout add timeout_1 inet tcp syn_sent 100 established 200
    $ ovs-ofctl add-flow br0 in_port=1,ip,tcp,action=ct(commit,timeout=timeout_1)

    CC: Pravin Shelar
    CC: Pablo Neira Ayuso
    Signed-off-by: Yi-Hung Wei
    Acked-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    Yi-Hung Wei
     

28 Mar, 2019

1 commit

  • 4d5ec89fc   net: openvswitch: Add a new action check_pkt_len ... Browse Code »

    This patch adds a new action - 'check_pkt_len' which checks the
    packet length and executes a set of actions if the packet
    length is greater than the specified length or executes
    another set of actions if the packet length is lesser or equal to.

    This action takes below nlattrs
    * OVS_CHECK_PKT_LEN_ATTR_PKT_LEN - 'pkt_len' to check for

    * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER - Nested actions
    to apply if the packet length is greater than the specified 'pkt_len'

    * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL - Nested
    actions to apply if the packet length is lesser or equal to the
    specified 'pkt_len'.

    The main use case for adding this action is to solve the packet
    drops because of MTU mismatch in OVN virtual networking solution.
    When a VM (which belongs to a logical switch of OVN) sends a packet
    destined to go via the gateway router and if the nic which provides
    external connectivity, has a lesser MTU, OVS drops the packet
    if the packet length is greater than this MTU.

    With the help of this action, OVN will check the packet length
    and if it is greater than the MTU size, it will generate an
    ICMP packet (type 3, code 4) and includes the next hop mtu in it
    so that the sender can fragment the packets.

    Reported-at:
    https://mail.openvswitch.org/pipermail/ovs-discuss/2018-July/047039.html
    Suggested-by: Ben Pfaff
    Signed-off-by: Numan Siddique
    CC: Gregory Rose
    CC: Pravin B Shelar
    Acked-by: Pravin B Shelar
    Tested-by: Greg Rose
    Reviewed-by: Greg Rose
    Signed-off-by: David S. Miller

    Numan Siddique
     

27 Mar, 2019

1 commit

  • fa7e428c6   openvswitch: add seqadj extension when NAT is used. ... Browse Code »

    When the conntrack is initialized, there is no helper attached
    yet so the nat info initialization (nf_nat_setup_info) skips
    adding the seqadj ext.

    A helper is attached later when the conntrack is not confirmed
    but is going to be committed. In this case, if NAT is needed then
    adds the seqadj ext as well.

    Fixes: 16ec3d4fbb96 ("openvswitch: Fix cached ct with helper.")
    Signed-off-by: Flavio Leitner
    Acked-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    Flavio Leitner
     

22 Mar, 2019

1 commit

  • 3b0f31f2b   genetlink: make policy common to family ... Browse Code »

    Since maxattr is common, the policy can't really differ sanely,
    so make it common as well.

    The only user that did in fact manage to make a non-common policy
    is taskstats, which has to be really careful about it (since it's
    still using a common maxattr!). This is no longer supported, but
    we can fake it using pre_doit.

    This reduces the size of e.g. nl80211.o (which has lots of commands):

    text data bss dec hex filename
    398745 14323 2240 415308 6564c net/wireless/nl80211.o (before)
    397913 14331 2240 414484 65314 net/wireless/nl80211.o (after)
    --------------------------------
    -832 +8 0 -824

    Which is obviously just 8 bytes for each command, and an added 8
    bytes for the new policy pointer. I'm not sure why the ops list is
    counted as .text though.

    Most of the code transformations were done using the following spatch:
    @ops@
    identifier OPS;
    expression POLICY;
    @@
    struct genl_ops OPS[] = {
    ...,
    {
    - .policy = POLICY,
    },
    ...
    };

    @@
    identifier ops.OPS;
    expression ops.POLICY;
    identifier fam;
    expression M;
    @@
    struct genl_family fam = {
    .ops = OPS,
    .maxattr = M,
    + .policy = POLICY,
    ...
    };

    This also gets rid of devlink_nl_cmd_region_read_dumpit() accessing
    the cb->data as ops, which we want to change in a later genl patch.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

17 Mar, 2019

2 commits

13 Mar, 2019

1 commit

  • ee9c5e675   openvswitch: convert to kvmalloc ... Browse Code »

    Patch series "generic radix trees; drop flex arrays".

    This patch (of 7):

    There was no real need for this code to be using flexarrays, it's just
    implementing a hash table - ideally it would be using rhashtables, but
    that conversion would be significantly more complicated.

    Link: http://lkml.kernel.org/r/20181217131929.11727-2-kent.overstreet@gmail.com
    Signed-off-by: Kent Overstreet
    Reviewed-by: Matthew Wilcox
    Cc: Pravin B Shelar
    Cc: Alexey Dobriyan
    Cc: Al Viro
    Cc: Dave Hansen
    Cc: Eric Paris
    Cc: Marcelo Ricardo Leitner
    Cc: Neil Horman
    Cc: Paul Moore
    Cc: Shaohua Li
    Cc: Stephen Smalley
    Cc: Vlad Yasevich
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kent Overstreet
     

27 Feb, 2019

2 commits

  • d2c5c103b   netfilter: nat: remove nf_nat_l3proto.h and nf_nat_core.h ... Browse Code »

    The l3proto name is gone, its header file is the last trace.
    While at it, also remove nf_nat_core.h, its very small and all users
    include nf_nat.h too.

    before:
    text data bss dec hex filename
    22948 1612 4136 28696 7018 nf_nat.ko

    after removal of l3proto register/unregister functions:
    text data bss dec hex filename
    22196 1516 4136 27848 6cc8 nf_nat.ko

    checkpatch complains about overly long lines, but line breaks
    do not make things more readable and the line length gets smaller
    here, not larger.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • 3bf195ae6   netfilter: nat: merge nf_nat_ipv4,6 into nat core ... Browse Code »

    before:
    text data bss dec hex filename
    16566 1576 4136 22278 5706 nf_nat.ko
    3598 844 0 4442 115a nf_nat_ipv6.ko
    3187 844 0 4031 fbf nf_nat_ipv4.ko

    after:
    text data bss dec hex filename
    22948 1612 4136 28696 7018 nf_nat.ko

    ... with ipv4/v6 nat now provided directly via nf_nat.ko.

    Also changes:
    ret = nf_nat_ipv4_fn(priv, skb, state);
    if (ret != NF_DROP && ret != NF_STOLEN &&
    into
    if (ret != NF_ACCEPT)
    return ret;

    everywhere.

    The nat hooks never should return anything other than
    ACCEPT or DROP (and the latter only in rare error cases).

    The original code uses multi-line ANDing including assignment-in-if:
    if (ret != NF_DROP && ret != NF_STOLEN &&
    !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {

    I removed this while moving, breaking those in separate conditionals
    and moving the assignments into extra lines.

    checkpatch still generates some warnings:
    1. Overly long lines (of moved code).
    Breaking them is even more ugly. so I kept this as-is.
    2. use of extern function declarations in a .c file.
    This is necessary evil, we must call
    nf_nat_l3proto_register() from the nat core now.
    All l3proto related functions are removed later in this series,
    those prototypes are then removed as well.

    v2: keep empty nf_nat_ipv6_csum_update stub for CONFIG_IPV6=n case.
    v3: remove IS_ENABLED(NF_NAT_IPV4/6) tests, NF_NAT_IPVx toggles
    are removed here.
    v4: also get rid of the assignments in conditionals.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

29 Jan, 2019

1 commit

  • 343917b41   Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next ... Browse Code »

    Pablo Neira Ayuso says:

    ====================
    Netfilter/IPVS updates for net-next

    The following patchset contains Netfilter/IPVS updates for your net-next tree:

    1) Introduce a hashtable to speed up object lookups, from Florian Westphal.

    2) Make direct calls to built-in extension, also from Florian.

    3) Call helper before confirming the conntrack as it used to be originally,
    from Florian.

    4) Call request_module() to autoload br_netfilter when physdev is used
    to relax the dependency, also from Florian.

    5) Allow to insert rules at a given position ID that is internal to the
    batch, from Phil Sutter.

    6) Several patches to replace conntrack indirections by direct calls,
    and to reduce modularization, from Florian. This also includes
    several follow up patches to deal with minor fallout from this
    rework.

    7) Use RCU from conntrack gre helper, from Florian.

    8) GRE conntrack module becomes built-in into nf_conntrack, from Florian.

    9) Replace nf_ct_invert_tuplepr() by calls to nf_ct_invert_tuple(),
    from Florian.

    10) Unify sysctl handling at the core of nf_conntrack, from Florian.

    11) Provide modparam to register conntrack hooks.

    12) Allow to match on the interface kind string, from wenxu.

    13) Remove several exported symbols, not required anymore now after
    a bit of de-modulatization work has been done, from Florian.

    14) Remove built-in map support in the hash extension, this can be
    done with the existing userspace infrastructure, from laura.

    15) Remove indirection to calculate checksums in IPVS, from Matteo Croce.

    16) Use call wrappers for indirection in IPVS, also from Matteo.

    17) Remove superfluous __percpu parameter in nft_counter, patch from
    Luc Van Oostenryck.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

22 Jan, 2019

1 commit

18 Jan, 2019

1 commit

17 Jan, 2019

2 commits

  • c5c3899de   openvswitch: meter: Use struct_size() in kzalloc() ... Browse Code »

    One of the more common cases of allocation size calculations is finding the
    size of a structure that has a zero-sized array at the end, along with memory
    for some number of elements for that array. For example:

    struct foo {
    int stuff;
    struct boo entry[];
    };

    instance = kzalloc(sizeof(struct foo) + count * sizeof(struct boo), GFP_KERNEL);

    Instead of leaving these open-coded and prone to type mistakes, we can now
    use the new struct_size() helper:

    instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);

    This code was detected with the help of Coccinelle.

    Signed-off-by: Gustavo A. R. Silva
    Signed-off-by: David S. Miller

    Gustavo A. R. Silva
     
  • 04a4af334   openvswitch: Avoid OOB read when parsing flow nlattrs ... Browse Code »

    For nested and variable attributes, the expected length of an attribute
    is not known and marked by a negative number. This results in an OOB
    read when the expected length is later used to check if the attribute is
    all zeros. Fix this by using the actual length of the attribute rather
    than the expected length.

    Signed-off-by: Ross Lagerwall
    Acked-by: Pravin B Shelar
    Signed-off-by: David S. Miller

    Ross Lagerwall
     

05 Jan, 2019

1 commit

  • 41e4e2cd7   openvswitch: Fix IPv6 later frags parsing ... Browse Code »

    The previous commit fa642f08839b
    ("openvswitch: Derive IP protocol number for IPv6 later frags")
    introduces IP protocol number parsing for IPv6 later frags that can mess
    up the network header length calculation logic, i.e. nh_len < 0.
    However, the network header length calculation is mainly for deriving
    the transport layer header in the key extraction process which the later
    fragment does not apply.

    Therefore, this commit skips the network header length calculation to
    fix the issue.

    Reported-by: Chris Mi
    Reported-by: Greg Rose
    Fixes: fa642f08839b ("openvswitch: Derive IP protocol number for IPv6 later frags")
    Signed-off-by: Yi-Hung Wei
    Signed-off-by: David S. Miller

    Yi-Hung Wei
     

10 Dec, 2018

1 commit

  • 4cc1feeb6   Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net ... Browse Code »

    Several conflicts, seemingly all over the place.

    I used Stephen Rothwell's sample resolutions for many of these, if not
    just to double check my own work, so definitely the credit largely
    goes to him.

    The NFP conflict consisted of a bug fix (moving operations
    past the rhashtable operation) while chaning the initial
    argument in the function call in the moved code.

    The net/dsa/master.c conflict had to do with a bug fix intermixing of
    making dsa_master_set_mtu() static with the fixing of the tagging
    attribute location.

    cls_flower had a conflict because the dup reject fix from Or
    overlapped with the addition of port range classifiction.

    __set_phy_supported()'s conflict was relatively easy to resolve
    because Andrew fixed it in both trees, so it was just a matter
    of taking the net-next copy. Or at least I think it was :-)

    Joe Stringer's fix to the handling of netns id 0 in bpf_sk_lookup()
    intermixed with changes on how the sdif and caller_net are calculated
    in these code paths in net-next.

    The remaining BPF conflicts were largely about the addition of the
    __bpf_md_ptr stuff in 'net' overlapping with adjustments and additions
    to the relevant data structure where the MD pointer macros are used.

    Signed-off-by: David S. Miller

    David S. Miller
     

07 Dec, 2018

1 commit

  • 567c5e13b   net: core: dev: Add extack argument to dev_change_flags() ... Browse Code »

    In order to pass extack together with NETDEV_PRE_UP notifications, it's
    necessary to route the extack to __dev_open() from diverse (possibly
    indirect) callers. One prominent API through which the notification is
    invoked is dev_change_flags().

    Therefore extend dev_change_flags() with and extra extack argument and
    update all users. Most of the calls end up just encoding NULL, but
    several sites (VLAN, ipvlan, VRF, rtnetlink) do have extack available.

    Since the function declaration line is changed anyway, name the other
    function arguments to placate checkpatch.

    Signed-off-by: Petr Machata
    Acked-by: Jiri Pirko
    Reviewed-by: Ido Schimmel
    Reviewed-by: David Ahern
    Signed-off-by: David S. Miller

    Petr Machata
     

01 Dec, 2018

1 commit

11 Nov, 2018

1 commit

09 Nov, 2018

2 commits

04 Nov, 2018

1 commit

  • a277d516d   openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS ... Browse Code »

    When CONFIG_CC_OPTIMIZE_FOR_DEBUGGING is enabled, the compiler
    fails to optimize out a dead code path, which leads to a link failure:

    net/openvswitch/conntrack.o: In function `ovs_ct_set_labels':
    conntrack.c:(.text+0x2e60): undefined reference to `nf_connlabels_replace'

    In this configuration, we can take a shortcut, and completely
    remove the contrack label code. This may also help the regular
    optimization.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: David S. Miller

    Arnd Bergmann
     

01 Nov, 2018

1 commit

  • 46ebe2834   openvswitch: Fix push/pop ethernet validation ... Browse Code »

    When there are both pop and push ethernet header actions among the
    actions to be applied to a packet, an unexpected EINVAL (Invalid
    argument) error is obtained. This is due to mac_proto not being reset
    correctly when those actions are validated.

    Reported-at:
    https://mail.openvswitch.org/pipermail/ovs-discuss/2018-October/047554.html
    Fixes: 91820da6ae85 ("openvswitch: add Ethernet push and pop actions")
    Signed-off-by: Jaime Caamaño Ruiz
    Tested-by: Greg Rose
    Reviewed-by: Greg Rose
    Signed-off-by: David S. Miller

    Jaime Caamaño Ruiz
     

09 Oct, 2018

1 commit

  • 9000a457a   Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next ... Browse Code »

    Pablo Neira Ayuso says:

    ====================
    Netfilter updates for net-next

    The following patchset contains Netfilter updates for your net-next tree:

    1) Support for matching on ipsec policy already set in the route, from
    Florian Westphal.

    2) Split set destruction into deactivate and destroy phase to make it
    fit better into the transaction infrastructure, also from Florian.
    This includes a patch to warn on imbalance when setting the new
    activate and deactivate interfaces.

    3) Release transaction list from the workqueue to remove expensive
    synchronize_rcu() from configuration plane path. This speeds up
    configuration plane quite a bit. From Florian Westphal.

    4) Add new xfrm/ipsec extension, this new extension allows you to match
    for ipsec tunnel keys such as source and destination address, spi and
    reqid. From Máté Eckl and Florian Westphal.

    5) Add secmark support, this includes connsecmark too, patches
    from Christian Gottsche.

    6) Allow to specify remaining bytes in xt_quota, from Chenbo Feng.
    One follow up patch to calm a clang warning for this one, from
    Nathan Chancellor.

    7) Flush conntrack entries based on layer 3 family, from Kristian Evensen.

    8) New revision for cgroups2 to shrink the path field.

    9) Get rid of obsolete need_conntrack(), as a result from recent
    demodularization works.

    10) Use WARN_ON instead of BUG_ON, from Florian Westphal.

    11) Unused exported symbol in nf_nat_ipv4_fn(), from Florian.

    12) Remove superfluous check for timeout netlink parser and dump
    functions in layer 4 conntrack helpers.

    13) Unnecessary redundant rcu read side locks in NAT redirect,
    from Taehee Yoo.

    14) Pass nf_hook_state structure to error handlers, patch from
    Florian Westphal.

    15) Remove ->new() interface from layer 4 protocol trackers. Place
    them in the ->packet() interface. From Florian.

    16) Place conntrack ->error() handling in the ->packet() interface.
    Patches from Florian Westphal.

    17) Remove unused parameter in the pernet initialization path,
    also from Florian.

    18) Remove additional parameter to specify layer 3 protocol when
    looking up for protocol tracker. From Florian.

    19) Shrink array of layer 4 protocol trackers, from Florian.

    20) Check for linear skb only once from the ALG NAT mangling
    codebase, from Taehee Yoo.

    21) Use rhashtable_walk_enter() instead of deprecated
    rhashtable_walk_init(), also from Taehee.

    22) No need to flush all conntracks when only one single address
    is gone, from Tan Hu.

    23) Remove redundant check for NAT flags in flowtable code, from
    Taehee Yoo.

    24) Use rhashtable_lookup() instead of rhashtable_lookup_fast()
    from netfilter codebase, since rcu read lock side is already
    assumed in this path.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

07 Oct, 2018

1 commit

05 Oct, 2018

1 commit

04 Oct, 2018

1 commit