13 Mar, 2020

13 commits

  • Legacy ioctl request like ETHTOOL_GTXCSUM are still used by ethtool utility
    to get values of legacy flags (which rather work as feature groups). These
    are calculated from values of actual features and request to set them is
    implemented as an attempt to set all features mapping to them but there are
    two inconsistencies:

    - tx-checksum-fcoe-crc is shown under tx-checksumming but NETIF_F_FCOE_CRC
    is not included in ETHTOOL_GTXCSUM/ETHTOOL_STXCSUM
    - tx-scatter-gather-fraglist is shown under scatter-gather but
    NETIF_F_FRAGLIST is not included in ETHTOOL_GSG/ETHTOOL_SSG

    As the mapping in ethtool output is more correct from logical point of
    view, fix ethtool_get_feature_mask() to match it.

    Signed-off-by: Michal Kubecek
    Signed-off-by: David S. Miller

    Michal Kubecek
     
  • Andrew Lunn pointed out that even if it's documented that
    ethnl_parse_header() takes reference to network device if it fills it
    into the target structure, its name doesn't make it apparent so that
    corresponding dev_put() looks like mismatched.

    Rename the function ethnl_parse_header_dev_get() to indicate that it
    takes a reference.

    Suggested-by: Andrew Lunn
    Signed-off-by: Michal Kubecek
    Signed-off-by: David S. Miller

    Michal Kubecek
     
  • Add relevant getter for ct info dissector.

    Signed-off-by: Paul Blakey
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • Pass the zone's flow table instance on the flow action to the drivers.
    Thus, allowing drivers to register FT add/del/stats callbacks.

    Finally, enable hardware offload on the flow table instance.

    Signed-off-by: Paul Blakey
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • If driver deleted an FT entry, a FT failed to offload, or registered to the
    flow table after flows were already added, we still get packets in
    software.

    For those packets, while restoring the ct state from the flow table
    entry, refresh it's hardware offload.

    Signed-off-by: Paul Blakey
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • Provide an API to restore the ct state pointer.

    This may be used by drivers to restore the ct state if they
    miss in tc chain after they already did the hardware connection
    tracking action (ct_metadata action).

    For example, consider the following rule on chain 0 that is in_hw,
    however chain 1 is not_in_hw:

    $ tc filter add dev ... chain 0 ... \
    flower ... action ct pipe action goto chain 1

    Packets of a flow offloaded (via nf flow table offload) by the driver
    hit this rule in hardware, will be marked with the ct metadata action
    (mark, label, zone) that does the equivalent of the software ct action,
    and when the packet jumps to hardware chain 1, there would be a miss.

    CT was already processed in hardware. Therefore, the driver's miss
    handling should restore the ct state on the skb, using the provided API,
    and continue the packet processing in chain 1.

    Signed-off-by: Paul Blakey
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • NF flow table API associate 5-tuple rule with an action list by calling
    the flow table type action() CB to fill the rule's actions.

    In action CB of act_ct, populate the ct offload entry actions with a new
    ct_metadata action. Initialize the ct_metadata with the ct mark, label and
    zone information. If ct nat was performed, then also append the relevant
    packet mangle actions (e.g. ipv4/ipv6/tcp/udp header rewrites).

    Drivers that offload the ft entries may match on the 5-tuple and perform
    the action list.

    Signed-off-by: Paul Blakey
    Reviewed-by: Jiri Pirko
    Reviewed-by: Edward Cree
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • Let drivers to add their cb allowing them to receive flow offload events
    of type TC_SETUP_CLSFLOWER (REPLACE/DEL/STATS) for flows managed by the
    flow table.

    Signed-off-by: Paul Blakey
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • David S. Miller
     
  • If there is no TCP_LISTEN socket on a ephemeral port, we can bind multiple
    sockets having SO_REUSEADDR to the same port. Then if all sockets bound to
    the port have also SO_REUSEPORT enabled and have the same EUID, all of them
    can be listened. This is not safe.

    Let's say, an application has root privilege and binds sockets to an
    ephemeral port with both of SO_REUSEADDR and SO_REUSEPORT. When none of
    sockets is not listened yet, a malicious user can use sudo, exhaust
    ephemeral ports, and bind sockets to the same ephemeral port, so he or she
    can call listen and steal the port.

    To prevent this issue, we must not bind more than one sockets that have the
    same EUID and both of SO_REUSEADDR and SO_REUSEPORT.

    On the other hand, if the sockets have different EUIDs, the issue above does
    not occur. After sockets with different EUIDs are bound to the same port and
    one of them is listened, no more socket can be listened. This is because the
    condition below is evaluated true and listen() for the second socket fails.

    } else if (!reuseport_ok ||
    !reuseport || !sk2->sk_reuseport ||
    rcu_access_pointer(sk->sk_reuseport_cb) ||
    (sk2->sk_state != TCP_TIME_WAIT &&
    !uid_eq(uid, sock_i_uid(sk2)))) {
    if (inet_rcv_saddr_equal(sk, sk2, true))
    break;
    }

    Therefore, on the same port, we cannot do listen() for multiple sockets with
    different EUIDs and any other listen syscalls fail, so the problem does not
    happen. In this case, we can still call connect() for other sockets that
    cannot be listened, so we have to succeed to call bind() in order to fully
    utilize 4-tuples.

    Summarizing the above, we should be able to bind only one socket having
    SO_REUSEADDR and SO_REUSEPORT per EUID.

    Signed-off-by: Kuniyuki Iwashima
    Signed-off-by: David S. Miller

    Kuniyuki Iwashima
     
  • Commit aacd9289af8b82f5fb01bcdd53d0e3406d1333c7 ("tcp: bind() use stronger
    condition for bind_conflict") introduced a restriction to forbid to bind
    SO_REUSEADDR enabled sockets to the same (addr, port) tuple in order to
    assign ports dispersedly so that we can connect to the same remote host.

    The change results in accelerating port depletion so that we fail to bind
    sockets to the same local port even if we want to connect to the different
    remote hosts.

    You can reproduce this issue by following instructions below.

    1. # sysctl -w net.ipv4.ip_local_port_range="32768 32768"
    2. set SO_REUSEADDR to two sockets.
    3. bind two sockets to (localhost, 0) and the latter fails.

    Therefore, when ephemeral ports are exhausted, bind(0) should fallback to
    the legacy behaviour to enable the SO_REUSEADDR option and make it possible
    to connect to different remote (addr, port) tuples.

    This patch allows us to bind SO_REUSEADDR enabled sockets to the same
    (addr, port) only when net.ipv4.ip_autobind_reuse is set 1 and all
    ephemeral ports are exhausted. This also allows connect() and listen() to
    share ports in the following way and may break some applications. So the
    ip_autobind_reuse is 0 by default and disables the feature.

    1. setsockopt(sk1, SO_REUSEADDR)
    2. setsockopt(sk2, SO_REUSEADDR)
    3. bind(sk1, saddr, 0)
    4. bind(sk2, saddr, 0)
    5. connect(sk1, daddr)
    6. listen(sk2)

    If it is set 1, we can fully utilize the 4-tuples, but we should use
    IP_BIND_ADDRESS_NO_PORT for bind()+connect() as possible.

    The notable thing is that if all sockets bound to the same port have
    both SO_REUSEADDR and SO_REUSEPORT enabled, we can bind sockets to an
    ephemeral port and also do listen().

    Signed-off-by: Kuniyuki Iwashima
    Signed-off-by: David S. Miller

    Kuniyuki Iwashima
     
  • When we get an ephemeral port, the relax is false, so the SO_REUSEADDR
    conditions may be evaluated twice. We do not need to check the conditions
    again.

    Signed-off-by: Kuniyuki Iwashima
    Signed-off-by: David S. Miller

    Kuniyuki Iwashima
     
  • This reverts commit 4cda75275f9f89f9485b0ca4d6950c95258a9bce
    from net-next.

    Brown bag time.

    Michal noticed that this change doesn't work at all when
    netif_set_real_num_tx_queues() gets called prior to an initial
    dev_activate(), as for instance igb does.

    Doing so dies with:

    [ 40.579142] BUG: kernel NULL pointer dereference, address: 0000000000000400
    [ 40.586922] #PF: supervisor read access in kernel mode
    [ 40.592668] #PF: error_code(0x0000) - not-present page
    [ 40.598405] PGD 0 P4D 0
    [ 40.601234] Oops: 0000 [#1] PREEMPT SMP PTI
    [ 40.605909] CPU: 18 PID: 1681 Comm: wickedd Tainted: G E 5.6.0-rc3-ethnl.50-default #1
    [ 40.616205] Hardware name: Intel Corporation S2600CP/S2600CP, BIOS RMLSDP.86I.R3.27.D685.1305151734 05/15/2013
    [ 40.627377] RIP: 0010:qdisc_hash_add.part.22+0x2e/0x90
    [ 40.633115] Code: 00 55 53 89 f5 48 89 fb e8 2f 9b fb ff 85 c0 74 44 48 8b 43 40 48 8b 08 69 43 38 47 86 c8 61 c1 e8 1c 48 83 e8 80 48 8d 14 c1 8b 04 c1 48 8d 4b 28 48 89 53 30 48 89 43 28 48 85 c0 48 89 0a
    [ 40.654080] RSP: 0018:ffffb879864934d8 EFLAGS: 00010203
    [ 40.659914] RAX: 0000000000000080 RBX: ffffffffb8328d80 RCX: 0000000000000000
    [ 40.667882] RDX: 0000000000000400 RSI: 0000000000000000 RDI: ffffffffb831faa0
    [ 40.675849] RBP: 0000000000000000 R08: ffffa0752c8b9088 R09: ffffa0752c8b9208
    [ 40.683816] R10: 0000000000000006 R11: 0000000000000000 R12: ffffa0752d734000
    [ 40.691783] R13: 0000000000000008 R14: 0000000000000000 R15: ffffa07113c18000
    [ 40.699750] FS: 00007f94548e5880(0000) GS:ffffa0752e980000(0000) knlGS:0000000000000000
    [ 40.708782] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 40.715189] CR2: 0000000000000400 CR3: 000000082b6ae006 CR4: 00000000001606e0
    [ 40.723156] Call Trace:
    [ 40.725888] dev_qdisc_set_real_num_tx_queues+0x61/0x90
    [ 40.731725] netif_set_real_num_tx_queues+0x94/0x1d0
    [ 40.737286] __igb_open+0x19a/0x5d0 [igb]
    [ 40.741767] __dev_open+0xbb/0x150
    [ 40.745567] __dev_change_flags+0x157/0x1a0
    [ 40.750240] dev_change_flags+0x23/0x60

    [...]

    Fixes: 4cda75275f9f ("net: sched: make newly activated qdiscs visible")
    Reported-by: Michal Kubecek
    CC: Michal Kubecek
    CC: Eric Dumazet
    CC: Jamal Hadi Salim
    CC: Cong Wang
    CC: Jiri Pirko
    Signed-off-by: Julian Wiedmann
    Signed-off-by: David S. Miller

    Julian Wiedmann
     

12 Mar, 2020

5 commits

  • the following packetdrill script

    socket(..., SOCK_STREAM, IPPROTO_MPTCP) = 3
    fcntl(3, F_GETFL) = 0x2 (flags O_RDWR)
    fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
    connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress)
    > S 0:0(0)
    < S. 0:0(0) ack 1 win 65535
    > . 1:1(0) ack 1 win 256
    getsockopt(3, SOL_SOCKET, SO_ERROR, [0], [4]) = 0
    fcntl(3, F_SETFL, O_RDWR) = 0
    write(3, ..., 1000) = 1000

    doesn't transmit 1KB data packet after a successful three-way-handshake,
    using mp_capable with data as required by protocol v1, and write() hangs
    forever:

    PID: 973 TASK: ffff97dd399cae80 CPU: 1 COMMAND: "packetdrill"
    #0 [ffffa9b94062fb78] __schedule at ffffffff9c90a000
    #1 [ffffa9b94062fc08] schedule at ffffffff9c90a4a0
    #2 [ffffa9b94062fc18] schedule_timeout at ffffffff9c90e00d
    #3 [ffffa9b94062fc90] wait_woken at ffffffff9c120184
    #4 [ffffa9b94062fcb0] sk_stream_wait_connect at ffffffff9c75b064
    #5 [ffffa9b94062fd20] mptcp_sendmsg at ffffffff9c8e801c
    #6 [ffffa9b94062fdc0] sock_sendmsg at ffffffff9c747324
    #7 [ffffa9b94062fdd8] sock_write_iter at ffffffff9c7473c7
    #8 [ffffa9b94062fe48] new_sync_write at ffffffff9c302976
    #9 [ffffa9b94062fed0] vfs_write at ffffffff9c305685
    #10 [ffffa9b94062ff00] ksys_write at ffffffff9c305985
    #11 [ffffa9b94062ff38] do_syscall_64 at ffffffff9c004475
    #12 [ffffa9b94062ff50] entry_SYSCALL_64_after_hwframe at ffffffff9ca0008c
    RIP: 00007f959407eaf7 RSP: 00007ffe9e95a910 RFLAGS: 00000293
    RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f959407eaf7
    RDX: 00000000000003e8 RSI: 0000000001785fe0 RDI: 0000000000000008
    RBP: 0000000001785fe0 R8: 0000000000000000 R9: 0000000000000003
    R10: 0000000000000007 R11: 0000000000000293 R12: 00000000000003e8
    R13: 00007ffe9e95ae30 R14: 0000000000000000 R15: 0000000000000000
    ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b

    Fix it ensuring that socket state is TCP_ESTABLISHED on reception of the
    third ack.

    Fixes: 1954b86016cf ("mptcp: Check connection state before attempting send")
    Suggested-by: Paolo Abeni
    Signed-off-by: Davide Caratti
    Signed-off-by: David S. Miller

    Davide Caratti
     
  • Sparse reports a warning at netlink_seq_start()

    warning: context imbalance in netlink_seq_start() - wrong count at exit
    The root cause is the missing annotation at netlink_seq_start()
    Add the missing __acquires(RCU) annotation

    Signed-off-by: Jules Irenge
    Signed-off-by: David S. Miller

    Jules Irenge
     
  • Sparse reports warning at tcp_child_process()
    warning: context imbalance in tcp_child_process() - unexpected unlock
    The root cause is the missing annotation at tcp_child_process()

    Add the missing __releases(&((child)->sk_lock.slock)) annotation

    Signed-off-by: Jules Irenge
    Reviewed-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Jules Irenge
     
  • Sparse reports warnings at raw_seq_start() and raw_seq_stop()

    warning: context imbalance in raw_seq_start() - wrong count at exit
    warning: context imbalance in raw_seq_stop() - unexpected unlock

    The root cause is the missing annotations at raw_seq_start()
    and raw_seq_stop()
    Add the missing __acquires(&h->lock) annotation
    Add the missing __releases(&h->lock) annotation

    Signed-off-by: Jules Irenge
    Signed-off-by: David S. Miller

    Jules Irenge
     
  • In their .attach callback, mq[prio] only add the qdiscs of the currently
    active TX queues to the device's qdisc hash list.
    If a user later increases the number of active TX queues, their qdiscs
    are not visible via eg. 'tc qdisc show'.

    Add a hook to netif_set_real_num_tx_queues() that walks all active
    TX queues and adds those which are missing to the hash list.

    CC: Eric Dumazet
    CC: Jamal Hadi Salim
    CC: Cong Wang
    CC: Jiri Pirko
    Signed-off-by: Julian Wiedmann
    Signed-off-by: David S. Miller

    Julian Wiedmann
     

11 Mar, 2020

1 commit

  • When pktgen is used to measure the performance of dev_queue_xmit()
    packet handling in the core, it is preferable to not hand down
    packets to a low-level Ethernet driver as it would distort the
    measurements.

    Allow using pktgen on the loopback device, thus constraining
    measurements to core code.

    Signed-off-by: Lukas Wunner
    Signed-off-by: David S. Miller

    Lukas Wunner
     

10 Mar, 2020

4 commits


09 Mar, 2020

3 commits

  • Convert zones_lock spinlock to zones_mutex mutex,
    and struct (tcf_ct_flow_table)->ref to a refcount,
    so that control path can use regular GFP_KERNEL allocations
    from standard process context. This is more robust
    in case of memory pressure.

    The refcount is needed because tcf_ct_flow_table_put() can
    be called from RCU callback, thus in BH context.

    The issue was spotted by syzbot, as rhashtable_init()
    was called with a spinlock held, which is bad since GFP_KERNEL
    allocations can sleep.

    Note to developers : Please make sure your patches are tested
    with CONFIG_DEBUG_ATOMIC_SLEEP=y

    BUG: sleeping function called from invalid context at mm/slab.h:565
    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9582, name: syz-executor610
    2 locks held by syz-executor610/9582:
    #0: ffffffff8a34eb80 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
    #0: ffffffff8a34eb80 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5437
    #1: ffffffff8a3961b8 (zones_lock){+...}, at: spin_lock_bh include/linux/spinlock.h:343 [inline]
    #1: ffffffff8a3961b8 (zones_lock){+...}, at: tcf_ct_flow_table_get+0xa3/0x1700 net/sched/act_ct.c:67
    Preemption disabled at:
    [] 0x0
    CPU: 0 PID: 9582 Comm: syz-executor610 Not tainted 5.6.0-rc3-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x188/0x20d lib/dump_stack.c:118
    ___might_sleep.cold+0x1f4/0x23d kernel/sched/core.c:6798
    slab_pre_alloc_hook mm/slab.h:565 [inline]
    slab_alloc_node mm/slab.c:3227 [inline]
    kmem_cache_alloc_node_trace+0x272/0x790 mm/slab.c:3593
    __do_kmalloc_node mm/slab.c:3615 [inline]
    __kmalloc_node+0x38/0x60 mm/slab.c:3623
    kmalloc_node include/linux/slab.h:578 [inline]
    kvmalloc_node+0x61/0xf0 mm/util.c:574
    kvmalloc include/linux/mm.h:645 [inline]
    kvzalloc include/linux/mm.h:653 [inline]
    bucket_table_alloc+0x8b/0x480 lib/rhashtable.c:175
    rhashtable_init+0x3d2/0x750 lib/rhashtable.c:1054
    nf_flow_table_init+0x16d/0x310 net/netfilter/nf_flow_table_core.c:498
    tcf_ct_flow_table_get+0xe33/0x1700 net/sched/act_ct.c:82
    tcf_ct_init+0xba4/0x18a6 net/sched/act_ct.c:1050
    tcf_action_init_1+0x697/0xa20 net/sched/act_api.c:945
    tcf_action_init+0x1e9/0x2f0 net/sched/act_api.c:1001
    tcf_action_add+0xdb/0x370 net/sched/act_api.c:1411
    tc_ctl_action+0x366/0x456 net/sched/act_api.c:1466
    rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5440
    netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2478
    netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
    netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329
    netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918
    sock_sendmsg_nosec net/socket.c:652 [inline]
    sock_sendmsg+0xcf/0x120 net/socket.c:672
    ____sys_sendmsg+0x6b9/0x7d0 net/socket.c:2343
    ___sys_sendmsg+0x100/0x170 net/socket.c:2397
    __sys_sendmsg+0xec/0x1b0 net/socket.c:2430
    do_syscall_64+0xf6/0x790 arch/x86/entry/common.c:294
    entry_SYSCALL_64_after_hwframe+0x49/0xbe
    RIP: 0033:0x4403d9
    Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
    RSP: 002b:00007ffd719af218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
    RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403d9
    RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003
    RBP: 00000000006ca018 R08: 0000000000000005 R09: 00000000004002c8
    R10: 0000000000000008 R11: 00000000000

    Fixes: c34b961a2492 ("net/sched: act_ct: Create nf flow table per zone")
    Signed-off-by: Eric Dumazet
    Cc: Paul Blakey
    Cc: Jiri Pirko
    Reported-by: syzbot
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Currently, user who is adding an action expects HW to report stats,
    however it does not have exact expectations about the stats types.
    That is aligned with TCA_ACT_HW_STATS_TYPE_ANY.

    Allow user to specify the type of HW stats for an action and require it.

    Pass the information down to flow_offload layer.

    Signed-off-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Jiri Pirko
     
  • Introduce flow_action_basic_hw_stats_types_check() helper and use it
    in drivers. That sanitizes the drivers which do not have support
    for action HW stats types.

    Signed-off-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Jiri Pirko
     

06 Mar, 2020

3 commits

  • Invoke ndo_setup_tc() as appropriate to signal init / replacement,
    destroying and dumping of pFIFO / bFIFO Qdisc.

    A lot of the FIFO logic is used for pFIFO_head_drop as well, but that's a
    semantically very different Qdisc that isn't really in the same boat as
    pFIFO / bFIFO. Split some of the functions to keep the Qdisc intact.

    Signed-off-by: Petr Machata
    Signed-off-by: Ido Schimmel
    Acked-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Petr Machata
     
  • Linux supports 22 different interrupt coalescing parameters.
    No driver implements them all. Some drivers just ignore the
    ones they don't support, while others have to carry a long
    list of checks to reject unsupported settings.

    To simplify the drivers add the ability to specify inside
    ethtool_ops which parameters are supported and let the core
    reject attempts to set any other one.

    This commit makes the mechanism an opt-in, only drivers which
    set ethtool_opts->coalesce_types to a non-zero value will have
    the checks enforced.

    The same mask is used for global and per queue settings.

    v3: - move the (temporary) check if driver defines types
    earlier (Michal)
    - rename used_types -> nonzero_params, and
    coalesce_types -> supported_coalesce_params (Alex)
    - use EOPNOTSUPP instead of EINVAL (Andrew, Michal)

    Leaving the long series of ifs for now, it seems nice to
    be able to grep for the field and flag names. This will
    probably have to be revisited once netlink support lands.

    Signed-off-by: Jakub Kicinski
    Reviewed-by: Jacob Keller
    Reviewed-by: Michal Kubecek
    Reviewed-by: Andrew Lunn
    Reviewed-by: Alexander Duyck
    Signed-off-by: David S. Miller

    Jakub Kicinski
     
  • In the commit e0a4b99773d3 ("hsr: use upper/lower device infrastructure"),
    dev_get() was removed but dev_put() in the error path wasn't removed.
    So, if creating hsr interface command is failed, the reference counter leak
    of lower interface would occur.

    Test commands:
    ip link add dummy0 type dummy
    ip link add ipvlan0 link dummy0 type ipvlan mode l2
    ip link add ipvlan1 link dummy0 type ipvlan mode l2
    ip link add hsr0 type hsr slave1 ipvlan0 slave2 ipvlan1
    ip link del ipvlan0

    Result:
    [ 633.271992][ T1280] unregister_netdevice: waiting for ipvlan0 to become free. Usage count = -1

    Fixes: e0a4b99773d3 ("hsr: use upper/lower device infrastructure")
    Signed-off-by: Taehee Yoo
    Signed-off-by: David S. Miller

    Taehee Yoo
     

05 Mar, 2020

6 commits

  • Ocelot has the concept of a CPU port. The CPU port is represented in the
    forwarding and the queueing system, but it is not a physical device. The
    CPU port can either be accessed via register-based injection/extraction
    (which is the case of Ocelot), via Frame-DMA (similar to the first one),
    or "connected" to a physical Ethernet port (called NPI in the datasheet)
    which is the case of the Felix DSA switch.

    In Ocelot the CPU port is at index 11.
    In Felix the CPU port is at index 6.

    The CPU bit is treated special in the forwarding, as it is never cleared
    from the forwarding port mask (once added to it). Other than that, it is
    treated the same as a normal front port.

    Both Felix and Ocelot should use the CPU port in the same way. This
    means that Felix should not use the NPI port directly when forwarding to
    the CPU, but instead use the CPU port.

    This patch is fixing this such that Felix will use port 6 as its CPU
    port, and just use the NPI port to carry the traffic.

    Therefore, eliminate the "ocelot->cpu" variable which was holding the
    index of the NPI port for Felix, and the index of the CPU port module
    for Ocelot, so the variable was actually configuring different things
    for different drivers and causing at least part of the confusion.

    Also remove the "ocelot->num_cpu_ports" variable, which is the result of
    another confusion. The 2 CPU ports mentioned in the datasheet are
    because there are two frame extraction channels (register based or DMA
    based). This is of no relevance to the driver at the moment, and
    invisible to the analyzer module.

    Signed-off-by: Vladimir Oltean
    Suggested-by: Allan W. Nielsen
    Signed-off-by: David S. Miller

    Vladimir Oltean
     
  • The variable pie_vars->accu_prob is used as an accumulator for
    probability values. Since probabilty values are scaled using the
    MAX_PROB macro denoting (2^64 - 1), pie_vars->accu_prob is
    likely to overflow as it is of type u64.

    The variable pie_vars->accu_prob_overflows counts the number of
    times the variable pie_vars->accu_prob overflows.

    The MAX_PROB macro needs to be equal to at least (2^39 - 1) in
    order to do precise calculations without any underflow. Thus
    MAX_PROB can be reduced to (2^56 - 1) without affecting the
    precision in calculations drastically. Doing so will eliminate
    the need for the variable pie_vars->accu_prob_overflows as the
    variable pie_vars->accu_prob will never overflow.

    Removing the variable pie_vars->accu_prob_overflows also reduces
    the size of the structure pie_vars to exactly 64 bytes.

    Signed-off-by: Mohit P. Tahiliani
    Signed-off-by: Gautam Ramakrishnan
    Signed-off-by: Leslie Monis
    Signed-off-by: David S. Miller

    Leslie Monis
     
  • In function pie_calculate_probability(), the variables alpha and
    beta are of type u64. The variables qdelay, qdelay_old and
    params->target are of type psched_time_t (which is also u64).
    The explicit type casting done when calculating the value for
    the variable delta is redundant and not required.

    Signed-off-by: Mohit P. Tahiliani
    Signed-off-by: Gautam Ramakrishnan
    Signed-off-by: Leslie Monis
    Signed-off-by: David S. Miller

    Leslie Monis
     
  • Remove ambiguity by using the term backlog instead of qlen when
    representing the queue length in bytes.

    Signed-off-by: Mohit P. Tahiliani
    Signed-off-by: Gautam Ramakrishnan
    Signed-off-by: Leslie Monis
    Signed-off-by: David S. Miller

    Leslie Monis
     
  • To make the filler functions more generic, use network
    relative skb pulling.

    Signed-off-by: Paul Blakey
    Acked-by: Marcelo Ricardo Leitner
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     
  • When checking the protocol number tcf_ct_flow_table_lookup() handles
    the flow as if it's always ipv4, while it can be ipv6.

    Instead, refactor the code to fetch the tcp header, if available,
    in the relevant family (ipv4/ipv6) filler function, and do the
    check on the returned tcp header.

    Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established flows")
    Signed-off-by: Paul Blakey
    Acked-by: Marcelo Ricardo Leitner
    Reviewed-by: Jiri Pirko
    Signed-off-by: David S. Miller

    Paul Blakey
     

04 Mar, 2020

5 commits

  • Due to the immense variety of classification keys and actions available
    for tc-flower, as well as due to potentially very different DSA switch
    capabilities, it doesn't make a lot of sense for the DSA mid layer to
    even attempt to interpret these. So just pass them on to the underlying
    switch driver.

    DSA implements just the standard boilerplate for binding and unbinding
    flow blocks to ports, since nobody wants to deal with that.

    Signed-off-by: Vladimir Oltean
    Reviewed-by: Florian Fainelli
    Signed-off-by: David S. Miller

    Vladimir Oltean
     
  • The 2 second delay before calling qrtr_ns_init() meant that the remote
    processors would register as endpoints in qrtr and the say_hello() call
    would therefor broadcast the outgoing HELLO to them. With the HELLO
    handshake corrected this delay is no longer needed.

    Reviewed-by: Manivannan Sadhasivam
    Tested-by: Manivannan Sadhasivam
    Signed-off-by: Bjorn Andersson
    Signed-off-by: David S. Miller

    Bjorn Andersson
     
  • Lost in the translation from the user space implementation was the
    detail that HELLO mesages must be exchanged between each node pair. As
    such the incoming HELLO must be replied to.

    Similar to the previous implementation no effort is made to prevent two
    Linux boxes from continuously sending HELLO messages back and forth,
    this is left to a follow up patch.

    say_hello() is moved, to facilitate the new call site.

    Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace")
    Reviewed-by: Manivannan Sadhasivam
    Tested-by: Manivannan Sadhasivam
    Signed-off-by: Bjorn Andersson
    Signed-off-by: David S. Miller

    Bjorn Andersson
     
  • When a DATA_FIN is sent in a MPTCP DSS option that contains a data
    mapping, the DATA_FIN consumes one byte of space in the mapping. In this
    case, the DATA_FIN should only be included in the DSS option if its
    sequence number aligns with the end of the mapped data. Otherwise the
    subflow can send an incorrect implicit sequence number for the DATA_FIN,
    and the DATA_ACK for that sequence number would not close the
    MPTCP-level connection correctly.

    Signed-off-by: Mat Martineau
    Signed-off-by: David S. Miller

    Mat Martineau
     
  • Instead of reading the MPTCP-level sequence number when sending DATA_FIN,
    store the data in the subflow so it can be safely accessed when the
    subflow TCP headers are written to the packet without the MPTCP-level
    lock held. This also allows the MPTCP-level socket to close individual
    subflows without closing the MPTCP connection.

    Signed-off-by: Mat Martineau
    Signed-off-by: David S. Miller

    Mat Martineau