20 Oct, 2012

2 commits

  • Pull TTY fixes from Greg Kroah-Hartman:
    "Here are some tty and serial driver fixes for your 3.7-rc1 tree.

    Again, the UABI header file fixes, and a number of build and runtime
    serial driver bugfixes that solve problems people have been reporting
    (the staging driver is a tty driver, hence the fixes coming in through
    this tree.)

    All of these have been in the linux-next tree for a while.

    Signed-off-by: Greg Kroah-Hartman "

    * tag 'tty-3.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    staging: dgrp: check return value of alloc_tty_driver
    staging: dgrp: check for NULL pointer in (un)register_proc_table
    serial/8250_hp300: Missing 8250 register interface conversion bits
    UAPI: (Scripted) Disintegrate include/linux/hsi
    tty: serial: sccnxp: Fix bug with unterminated platform_id list
    staging: serial: dgrp: Add missing #include
    serial: sccnxp: Allows the driver to be compiled as a module
    tty: Fix bogus "callbacks suppressed" messages
    net, TTY: initialize tty->driver_data before usage

    Linus Torvalds
     
  • Pull nfsd bugfixes from J Bruce Fields.

    * 'for-3.7' of git://linux-nfs.org/~bfields/linux:
    SUNRPC: Prevent kernel stack corruption on long values of flush
    NLM: nlm_lookup_file() may return NLMv4-specific error codes

    Linus Torvalds
     

18 Oct, 2012

1 commit

  • The buffer size in read_flush() is too small for the longest possible values
    for it. This can lead to a kernel stack corruption:

    [ 43.047329] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff833e64b4
    [ 43.047329]
    [ 43.049030] Pid: 6015, comm: trinity-child18 Tainted: G W 3.5.0-rc7-next-20120716-sasha #221
    [ 43.050038] Call Trace:
    [ 43.050435] [] panic+0xcd/0x1f4
    [ 43.050931] [] ? read_flush.isra.7+0xe4/0x100
    [ 43.051602] [] __stack_chk_fail+0x16/0x20
    [ 43.052206] [] read_flush.isra.7+0xe4/0x100
    [ 43.052951] [] ? read_flush_pipefs+0x30/0x30
    [ 43.053594] [] read_flush_procfs+0x2c/0x30
    [ 43.053596] [] proc_reg_read+0x9c/0xd0
    [ 43.053596] [] ? proc_reg_write+0xd0/0xd0
    [ 43.053596] [] do_loop_readv_writev+0x4b/0x90
    [ 43.053596] [] do_readv_writev+0xf6/0x1d0
    [ 43.053596] [] vfs_readv+0x3e/0x60
    [ 43.053596] [] sys_readv+0x48/0xb0
    [ 43.053596] [] system_call_fastpath+0x1a/0x1f

    Signed-off-by: Sasha Levin
    Cc: stable@kernel.org
    Signed-off-by: J. Bruce Fields

    Sasha Levin
     

17 Oct, 2012

3 commits

  • Commit 1d5783030a1 (ipv6/addrconf: speedup /proc/net/if_inet6 filling)
    added bugs hiding some devices from if_inet6 and breaking applications.

    "ip -6 addr" could still display all IPv6 addresses, while "ifconfig -a"
    couldnt.

    One way to reproduce the bug is by starting in a shell :

    unshare -n /bin/bash
    ifconfig lo up

    And in original net namespace, lo device disappeared from if_inet6

    Reported-by: Jan Hinnerk Stosch
    Tested-by: Jan Hinnerk Stosch
    Signed-off-by: Eric Dumazet
    Cc: Mihai Maruseac
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Bug introduced by commit edfee0339e681a784ebacec7e8c2dc97dc6d2839
    (sctp: check src addr when processing SACK to update transport state)

    Signed-off-by: Zijie Pan
    Signed-off-by: Nicolas Dichtel
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Zijie Pan
     
  • In vlan_uses_dev() check for number of vlan devs rather than existence
    of vlan_info. The reason is that vlan id 0 is there without appropriate
    vlan dev on it by default which prevented from enslaving vlan challenged
    dev.

    Reported-by: Jon Stanley
    Signed-off-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Jiri Pirko
     

15 Oct, 2012

2 commits

  • This syncs up the tty-linus branch to the latest in Linus's tree to get all of
    the UAPI stuff needed for the next set of patches to merge.

    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     
  • Pull module signing support from Rusty Russell:
    "module signing is the highlight, but it's an all-over David Howells frenzy..."

    Hmm "Magrathea: Glacier signing key". Somebody has been reading too much HHGTTG.

    * 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (37 commits)
    X.509: Fix indefinite length element skip error handling
    X.509: Convert some printk calls to pr_devel
    asymmetric keys: fix printk format warning
    MODSIGN: Fix 32-bit overflow in X.509 certificate validity date checking
    MODSIGN: Make mrproper should remove generated files.
    MODSIGN: Use utf8 strings in signer's name in autogenerated X.509 certs
    MODSIGN: Use the same digest for the autogen key sig as for the module sig
    MODSIGN: Sign modules during the build process
    MODSIGN: Provide a script for generating a key ID from an X.509 cert
    MODSIGN: Implement module signature checking
    MODSIGN: Provide module signing public keys to the kernel
    MODSIGN: Automatically generate module signing keys if missing
    MODSIGN: Provide Kconfig options
    MODSIGN: Provide gitignore and make clean rules for extra files
    MODSIGN: Add FIPS policy
    module: signature checking hook
    X.509: Add a crypto key parser for binary (DER) X.509 certificates
    MPILIB: Provide a function to read raw data into an MPI
    X.509: Add an ASN.1 decoder
    X.509: Add simple ASN.1 grammar compiler
    ...

    Linus Torvalds
     

14 Oct, 2012

1 commit


13 Oct, 2012

7 commits

  • Pull nfsd update from J Bruce Fields:
    "Another relatively quiet cycle. There was some progress on my
    remaining 4.1 todo's, but a couple of them were just of the form
    "check that we do X correctly", so didn't have much affect on the
    code.

    Other than that, a bunch of cleanup and some bugfixes (including an
    annoying NFSv4.0 state leak and a busy-loop in the server that could
    cause it to peg the CPU without making progress)."

    * 'for-3.7' of git://linux-nfs.org/~bfields/linux: (46 commits)
    UAPI: (Scripted) Disintegrate include/linux/sunrpc
    UAPI: (Scripted) Disintegrate include/linux/nfsd
    nfsd4: don't allow reclaims of expired clients
    nfsd4: remove redundant callback probe
    nfsd4: expire old client earlier
    nfsd4: separate session allocation and initialization
    nfsd4: clean up session allocation
    nfsd4: minor free_session cleanup
    nfsd4: new_conn_from_crses should only allocate
    nfsd4: separate connection allocation and initialization
    nfsd4: reject bad forechannel attrs earlier
    nfsd4: enforce per-client sessions/no-sessions distinction
    nfsd4: set cl_minorversion at create time
    nfsd4: don't pin clientids to pseudoflavors
    nfsd4: fix bind_conn_to_session xdr comment
    nfsd4: cast readlink() bug argument
    NFSD: pass null terminated buf to kstrtouint()
    nfsd: remove duplicate init in nfsd4_cb_recall
    nfsd4: eliminate redundant nfs4_free_stateid
    fs/nfsd/nfs4idmap.c: adjust inconsistent IS_ERR and PTR_ERR
    ...

    Linus Torvalds
     
  • Pull networking updates from David Miller:

    1) Alexey Kuznetsov noticed we routed TCP resets improperly in the
    assymetric routing case, fix this by reverting a change that made us
    use the incoming interface in the outgoing route key when we didn't
    have a socket context to work with.

    2) TCP sysctl kernel memory leakage to userspace fix from Alan Cox.

    3) Move UAPI bits from David Howells, WIMAX and CAN this time.

    4) Fix TX stalls in e1000e wrt. Byte Queue Limits, from Hiroaki
    SHIMODA, Denys Fedoryshchenko, and Jesse Brandeburg.

    5) Fix IPV6 crashes in packet generator module, from Amerigo Wang.

    6) Tidies and fixes in the new VXLAN driver from Stephen Hemminger.

    7) Bridge IP options parse doesn't check first if SKB header has at
    least an IP header's worth of content present. Fix from Sarveshwar
    Bandi.

    8) The kernel now generates compound pages on transmit and the Xen
    netback drivers needs some adjustments in order to handle this. Fix
    from Ian Campbell.

    9) Turn off ASPM in JME driver, from Kevin Bardon and Matthew Garrett.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits)
    mcs7830: Fix link state detection
    net: add doc for in4_pton()
    net: add doc for in6_pton()
    vti: fix sparse bit endian warnings
    tcp: resets are misrouted
    usbnet: Support devices reporting idleness
    Add CDC-ACM support for the CX93010-2x UCMxx USB Modem
    net/ethernet/jme: disable ASPM
    tcp: sysctl interface leaks 16 bytes of kernel memory
    kaweth: print correct debug ptr
    e1000e: Change wthresh to 1 to avoid possible Tx stalls
    ipv4: fix route mark sparse warning
    xen: netback: handle compound page fragments on transmit.
    bridge: Pull ip header into skb->data before looking into ip header.
    isdn: fix a wrapping bug in isdn_ppp_ioctl()
    vxlan: fix oops when give unknown ifindex
    vxlan: fix receive checksum handling
    vxlan: add additional headroom
    vxlan: allow configuring port range
    vxlan: associate with tunnel socket on transmit
    ...

    Linus Torvalds
     
  • With user namespace support enabled building bluetooth generated the warning.
    net/bluetooth/af_bluetooth.c: In function ‘bt_seq_show’:
    net/bluetooth/af_bluetooth.c:598:7: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 7 has type ‘kuid_t’ [-Wformat]

    Convert sock_i_uid from a kuid_t to a uid_t before printing, to avoid
    this problem.

    Reported-by: Fengguang Wu
    Cc: Masatake YAMATO
    Cc: Gustavo Padovan
    Signed-off-by: "Eric W. Biederman"

    Eric W. Biederman
     
  • It is not easy to use in4_pton() correctly without reading
    its definition, so add some doc for it.

    Cc: David S. Miller
    Signed-off-by: Cong Wang
    Signed-off-by: David S. Miller

    Amerigo Wang
     
  • It is not easy to use in6_pton() correctly without reading
    its definition, so add some doc for it.

    Cc: David S. Miller
    Signed-off-by: Cong Wang
    Signed-off-by: David S. Miller

    Amerigo Wang
     
  • Use be32_to_cpu instead of htonl to keep sparse happy.

    Signed-off-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    stephen hemminger
     
  • After commit e2446eaa ("tcp_v4_send_reset: binding oif to iif in no
    sock case").. tcp resets are always lost, when routing is asymmetric.
    Yes, backing out that patch will result in misrouting of resets for
    dead connections which used interface binding when were alive, but we
    actually cannot do anything here. What's died that's died and correct
    handling normal unbound connections is obviously a priority.

    Comment to comment:
    > This has few benefits:
    > 1. tcp_v6_send_reset already did that.

    It was done to route resets for IPv6 link local addresses. It was a
    mistake to do so for global addresses. The patch fixes this as well.

    Actually, the problem appears to be even more serious than guaranteed
    loss of resets. As reported by Sergey Soloviev , those
    misrouted resets create a lot of arp traffic and huge amount of
    unresolved arp entires putting down to knees NAT firewalls which use
    asymmetric routing.

    Signed-off-by: Alexey Kuznetsov

    Alexey Kuznetsov
     

12 Oct, 2012

4 commits

  • Pull v9fs update from Eric Van Hensbergen.

    * tag 'for-linus-merge-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
    9P: Fix race between p9_write_work() and p9_fd_request()
    9P: Fix race in p9_write_work()
    9P: fix test at the end of p9_write_work()
    9P: Fix race in p9_read_work()
    9p: don't use __getname/__putname for uname/aname
    net/9p: Check errno validity
    fs/9p: avoid debug OOPS when reading a long symlink

    Linus Torvalds
     
  • If the rc_dereference of tcp_fastopen_ctx ever fails then we copy 16 bytes
    of kernel stack into the proc result.

    Signed-off-by: Alan Cox
    Signed-off-by: David S. Miller

    Alan Cox
     
  • Race scenario:

    thread A thread B

    p9_write_work() p9_fd_request()

    if (list_empty
    (&m->unsent_req_list))
    ...

    spin_lock(&client->lock);
    req->status = REQ_STATUS_UNSENT;
    list_add_tail(..., &m->unsent_req_list);
    spin_unlock(&client->lock);
    ....
    if (n & POLLOUT &&
    !test_and_set_bit(Wworksched, &m->wsched)
    schedule_work(&m->wq);
    --> not done because Wworksched is set

    clear_bit(Wworksched, &m->wsched);
    return;

    --> nobody will take care of sending the new request.

    This is not very likely to happen though, because p9_write_work()
    being called with an empty unsent_req_list is not frequent.
    But this also means that taking the lock earlier will not be costly.

    Signed-off-by: Simon Derr
    Signed-off-by: Eric Van Hensbergen

    Simon Derr
     
  • Merge branch 'bugfixes' of git://linux-nfs.org/~trondmy/nfs-2.6 into
    for-3.7-incoming. Mainly needed for Bryan's "SUNRPC: Set alloc_slot for
    backchannel tcp ops", without which the 4.1 server oopses.

    J. Bruce Fields
     

11 Oct, 2012

7 commits


10 Oct, 2012

5 commits

  • John W. Linville says:

    ====================
    Here is a batch of fixes intended for 3.7...

    Amitkumar Karwar provides a couple of mwifiex fixes to correctly
    report some reason codes for certain connection failures. He also
    provides a fix to cleanup after a scanning failure. Bing Zhao rounds
    that out with another mwifiex scanning fix.

    Daniel Golle gives us a fix for a copy/paste error in rt2x00.

    Felix Fietkau brings a couple of ath9k fixes related to suspend/resume,
    and a couple of fixes to prevent memory leaks in ath9k and mac80211.

    Ronald Wahl sends a carl9170 fix for a sleep in softirq context.

    Thomas Pedersen reorders some code to prevent drv_get_tsf from being
    called while holding a spinlock, now that it can sleep.

    Finally, Wei Yongjun prevents a NULL pointer dereference in the
    ath5k driver.

    Please let me know if there are problems!
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Pull NFS client updates from Trond Myklebust:
    "Features include:

    - Remove CONFIG_EXPERIMENTAL dependency from NFSv4.1
    Aside from the issues discussed at the LKS, distros are shipping
    NFSv4.1 with all the trimmings.
    - Fix fdatasync()/fsync() for the corner case of a server reboot.
    - NFSv4 OPEN access fix: finally distinguish correctly between
    open-for-read and open-for-execute permissions in all situations.
    - Ensure that the TCP socket is closed when we're in CLOSE_WAIT
    - More idmapper bugfixes
    - Lots of pNFS bugfixes and cleanups to remove unnecessary state and
    make the code easier to read.
    - In cases where a pNFS read or write fails, allow the client to
    resume trying layoutgets after two minutes of read/write-
    through-mds.
    - More net namespace fixes to the NFSv4 callback code.
    - More net namespace fixes to the NFSv3 locking code.
    - More NFSv4 migration preparatory patches.
    Including patches to detect network trunking in both NFSv4 and
    NFSv4.1
    - pNFS block updates to optimise LAYOUTGET calls."

    * tag 'nfs-for-3.7-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (113 commits)
    pnfsblock: cleanup nfs4_blkdev_get
    NFS41: send real read size in layoutget
    NFS41: send real write size in layoutget
    NFS: track direct IO left bytes
    NFSv4.1: Cleanup ugliness in pnfs_layoutgets_blocked()
    NFSv4.1: Ensure that the layout sequence id stays 'close' to the current
    NFSv4.1: Deal with seqid wraparound in the pNFS return-on-close code
    NFSv4 set open access operation call flag in nfs4_init_opendata_res
    NFSv4.1: Remove the dependency on CONFIG_EXPERIMENTAL
    NFSv4 reduce attribute requests for open reclaim
    NFSv4: nfs4_open_done first must check that GETATTR decoded a file type
    NFSv4.1: Deal with wraparound when updating the layout "barrier" seqid
    NFSv4.1: Deal with wraparound issues when updating the layout stateid
    NFSv4.1: Always set the layout stateid if this is the first layoutget
    NFSv4.1: Fix another refcount issue in pnfs_find_alloc_layout
    NFSv4: don't put ACCESS in OPEN compound if O_EXCL
    NFSv4: don't check MAY_WRITE access bit in OPEN
    NFS: Set key construction data for the legacy upcall
    NFSv4.1: don't do two EXCHANGE_IDs on mount
    NFS: nfs41_walk_client_list(): re-lock before iterating
    ...

    Linus Torvalds
     
  • This is to complete part of the Userspace API (UAPI) disintegration for which
    the preparatory patches were pulled recently. After these patches, userspace
    headers will be segregated into:

    include/uapi/linux/.../foo.h

    for the userspace interface stuff, and:

    include/linux/.../foo.h

    for the strictly kernel internal stuff.

    Signed-off-by: J. Bruce Fields

    J. Bruce Fields
     
  • This is the revised patch for fixing rds-ping spinlock recursion
    according to Venkat's suggestions.

    RDS ping/pong over TCP feature has been broken for years(2.6.39 to
    3.6.0) since we have to set TCP cork and call kernel_sendmsg() between
    ping/pong which both need to lock "struct sock *sk". However, this
    lock has already been hold before rds_tcp_data_ready() callback is
    triggerred. As a result, we always facing spinlock resursion which
    would resulting in system panic.

    Given that RDS ping is only used to test the connectivity and not for
    serious performance measurements, we can queue the pong transmit to
    rds_wq as a delayed response.

    Reported-by: Dan Carpenter
    CC: Venkat Venkatsubra
    CC: David S. Miller
    CC: James Morris
    Signed-off-by: Jie Liu
    Signed-off-by: David S. Miller

    jeff.liu
     
  • Pulled mainline in order to get the UAPI infrastructure already
    merged before I pull in David Howells's UAPI trees for networking.

    Signed-off-by: David S. Miller

    David S. Miller
     

09 Oct, 2012

8 commits

  • Empty nodes have no color. We can make use of this property to simplify
    the code emitted by the RB_EMPTY_NODE and RB_CLEAR_NODE macros. Also,
    we can get rid of the rb_init_node function which had been introduced by
    commit 88d19cf37952 ("timers: Add rb_init_node() to allow for stack
    allocated rb nodes") to avoid some issue with the empty node's color not
    being initialized.

    I'm not sure what the RB_EMPTY_NODE checks in rb_prev() / rb_next() are
    doing there, though. axboe introduced them in commit 10fd48f2376d
    ("rbtree: fixed reversed RB_EMPTY_NODE and rb_next/prev"). The way I
    see it, the 'empty node' abstraction is only used by rbtree users to
    flag nodes that they haven't inserted in any rbtree, so asking the
    predecessor or successor of such nodes doesn't make any sense.

    One final rb_init_node() caller was recently added in sysctl code to
    implement faster sysctl name lookups. This code doesn't make use of
    RB_EMPTY_NODE at all, and from what I could see it only called
    rb_init_node() under the mistaken assumption that such initialization was
    required before node insertion.

    [sfr@canb.auug.org.au: fix net/ceph/osd_client.c build]
    Signed-off-by: Michel Lespinasse
    Cc: Andrea Arcangeli
    Acked-by: David Woodhouse
    Cc: Rik van Riel
    Cc: Peter Zijlstra
    Cc: Daniel Santos
    Cc: Jens Axboe
    Cc: "Eric W. Biederman"
    Cc: John Stultz
    Signed-off-by: Stephen Rothwell
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Michel Lespinasse
     
  • After the change "Make neigh lookups directly in output packet path"
    (commit a263b30936) IPVS can not reach the real server for DR mode
    because we resolve the destination address from IP header, not from
    route neighbour. Use the new FLOWI_FLAG_KNOWN_NH flag to request
    output routes with known nexthop, so that it has preference
    on resolving.

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     
  • Add flag to request that output route should be
    returned with known rt_gateway, in case we want to use
    it as nexthop for neighbour resolving.

    The returned route can be cached as follows:

    - in NH exception: because the cached routes are not shared
    with other destinations
    - in FIB NH: when using gateway because all destinations for
    NH share same gateway

    As last option, to return rt_gateway!=0 we have to
    set DST_NOCACHE.

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     
  • Add new flag to remember when route is via gateway.
    We will use it to allow rt_gateway to contain address of
    directly connected host for the cases when DST_NOCACHE is
    used or when the NH exception caches per-destination route
    without DST_NOCACHE flag, i.e. when routes are not used for
    other destinations. By this way we force the neighbour
    resolving to work with the routed destination but we
    can use different address in the packet, feature needed
    for IPVS-DR where original packet for virtual IP is routed
    via route to real IP.

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     
  • Avoid checking nh_pcpu_rth_output in fast path,
    abort fib_info creation on alloc_percpu failure.

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     
  • After the change "Adjust semantics of rt->rt_gateway"
    (commit f8126f1d51) rt_gateway can be 0 but ip_forward() compares
    it directly with nexthop. What we want here is to check if traffic
    is to directly connected nexthop and to fail if using gateway.

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     
  • After "Cache input routes in fib_info nexthops" (commit
    d2d68ba9fe) and "Elide fib_validate_source() completely when possible"
    (commit 7a9bc9b81a) we can not send ICMP redirects. It seems we
    should not cache the RTCF_DOREDIRECT flag in nh_rth_input because
    the same fib_info can be used for traffic that is not redirected,
    eg. from other input devices or from sources that are not in same subnet.

    As result, we have to disable the caching of RTCF_DOREDIRECT
    flag and to force source validation for the case when forwarding
    traffic to the input device. If traffic comes from directly connected
    source we allow redirection as it was done before both changes.

    Avoid setting RTCF_DOREDIRECT if IN_DEV_TX_REDIRECTS
    is disabled, this can avoid source address validation and to
    help caching the routes.

    After the change "Adjust semantics of rt->rt_gateway"
    (commit f8126f1d51) we should make sure our ICMP_REDIR_HOST messages
    contain daddr instead of 0.0.0.0 when target is directly connected.

    Signed-off-by: Julian Anastasov
    Signed-off-by: David S. Miller

    Julian Anastasov
     
  • It seems IPV6_GRO_CB(skb)->proto can be destroyed in skb_gro_receive()
    if a new skb is allocated (to serve as an anchor for frag_list)

    We copy NAPI_GRO_CB() only (not the IPV6 specific part) in :

    *NAPI_GRO_CB(nskb) = *NAPI_GRO_CB(p);

    So we leave IPV6_GRO_CB(nskb)->proto to 0 (fresh skb allocation) instead
    of IPPROTO_TCP (6)

    ipv6_gro_complete() isnt able to call ops->gro_complete()
    [ tcp6_gro_complete() ]

    Fix this by moving proto in NAPI_GRO_CB() and getting rid of
    IPV6_GRO_CB

    Signed-off-by: Eric Dumazet
    Cc: Herbert Xu
    Signed-off-by: David S. Miller

    Eric Dumazet