summaryrefslogtreecommitdiff
path: root/net/xfrm/xfrm_state.c (follow)
Commit message (Collapse)AuthorAge
* Merge remote-tracking branch 'msm8998/lineage-20' into lineage-20Raghuram Subramani2024-10-17
| | | | Change-Id: I126075a330f305c85f8fe1b8c9d408f368be95d1
* Merge 4.4.244 into android-4.4-pGreg Kroah-Hartman2020-11-18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.244 ring-buffer: Fix recursion protection transitions between interrupt context gfs2: Wake up when sd_glock_disposal becomes zero mm: mempolicy: fix potential pte_unmap_unlock pte error time: Prevent undefined behaviour in timespec64_to_ns() btrfs: reschedule when cloning lots of extents net: xfrm: fix a race condition during allocing spi perf tools: Add missing swap for ino_generation ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() can: peak_usb: add range checking in decode operations can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping Btrfs: fix missing error return if writeback for extent buffer never started pinctrl: devicetree: Avoid taking direct reference to device name string i40e: Wrong truncation from u16 to u8 i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c geneve: add transport ports in route lookup for geneve ath9k_htc: Use appropriate rs_datalen type usb: gadget: goku_udc: fix potential crashes in probe gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free gfs2: check for live vs. read-only file system in gfs2_fitrim drm/amdgpu: perform srbm soft reset always on SDMA resume mac80211: fix use of skb payload instead of header cfg80211: regulatory: Fix inconsistent format argument iommu/amd: Increase interrupt remapping table limit to 512 entries xfs: fix a missing unlock on error in xfs_fs_map_blocks of/address: Fix of_node memory leak in of_dma_is_coherent cosa: Add missing kfree in error path of cosa_write perf: Fix get_recursion_context() ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA ext4: unlock xattr_sem properly in ext4_inline_data_truncate() usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode mei: protect mei_cl_mtu from null dereference ocfs2: initialize ip_next_orphan don't dump the threads that had been already exiting when zapped. drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] pinctrl: amd: use higher precision for 512 RtcClk pinctrl: amd: fix incorrect way to disable debounce filter swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb" IPv6: Set SIT tunnel hard_header_len to zero net/af_iucv: fix null pointer dereference on shutdown net/x25: Fix null-ptr-deref in x25_connect net: Update window_clamp if SOCK_RCVBUF is set random32: make prandom_u32() output unpredictable x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP xen/events: avoid removing an event channel while handling it xen/events: add a proper barrier to 2-level uevent unmasking xen/events: fix race in evtchn_fifo_unmask() xen/events: add a new "late EOI" evtchn framework xen/blkback: use lateeoi irq binding xen/netback: use lateeoi irq binding xen/scsiback: use lateeoi irq binding xen/pciback: use lateeoi irq binding xen/events: switch user event channels to lateeoi model xen/events: use a common cpu hotplug hook for event channels xen/events: defer eoi in case of excessive number of events xen/events: block rogue events for some time perf/core: Fix race in the perf_mmap_close() function Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" reboot: fix overflow parsing reboot cpu number ext4: fix leaking sysfs kobject after failed mount Convert trailing spaces and periods in path components Linux 4.4.244 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I70bf4c5ac9248a8ca3383b9b0c4871729606e75e
| * net: xfrm: fix a race condition during allocing spizhuoliang zhang2020-11-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit a779d91314ca7208b7feb3ad817b62904397c56d ] we found that the following race condition exists in xfrm_alloc_userspi flow: user thread state_hash_work thread ---- ---- xfrm_alloc_userspi() __find_acq_core() /*alloc new xfrm_state:x*/ xfrm_state_alloc() /*schedule state_hash_work thread*/ xfrm_hash_grow_check() xfrm_hash_resize() xfrm_alloc_spi /*hold lock*/ x->id.spi = htonl(spi) spin_lock_bh(&net->xfrm.xfrm_state_lock) /*waiting lock release*/ xfrm_hash_transfer() spin_lock_bh(&net->xfrm.xfrm_state_lock) /*add x into hlist:net->xfrm.state_byspi*/ hlist_add_head_rcu(&x->byspi) spin_unlock_bh(&net->xfrm.xfrm_state_lock) /*add x into hlist:net->xfrm.state_byspi 2 times*/ hlist_add_head_rcu(&x->byspi) 1. a new state x is alloced in xfrm_state_alloc() and added into the bydst hlist in __find_acq_core() on the LHS; 2. on the RHS, state_hash_work thread travels the old bydst and tranfers every xfrm_state (include x) into the new bydst hlist and new byspi hlist; 3. user thread on the LHS gets the lock and adds x into the new byspi hlist again. So the same xfrm_state (x) is added into the same list_hash (net->xfrm.state_byspi) 2 times that makes the list_hash become an inifite loop. To fix the race, x->id.spi = htonl(spi) in the xfrm_alloc_spi() is moved to the back of spin_lock_bh, sothat state_hash_work thread no longer add x which id.spi is zero into the hash_list. Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.") Signed-off-by: zhuoliang zhang <zhuoliang.zhang@mediatek.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | ANDROID: Temporarily disable XFRM_USER_COMPAT filteringAlistair Delva2020-11-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before 5.10-rc1, the upstream kernel blocked any compat calls into XFRM code with EOPNOTSUPP, however Android kernels had been patching this check out and made userspace match the 64-bit kernel netlink format instead. When the new XFRM_USER_COMPAT feature landed, it added a similar check in two places which returns EOPNOTSUPP only if the XFRM_USER_COMPAT feature is disabled, however that is currently always the case for Android kernels and we do not want to filter these callers. While we work to remove the userspace compatibility mess, disable the filtering of compat calls when XFRM_USER_COMPAT is disabled. If the XFRM_USER_COMPAT feature is enabled, nothing changes. Bug: 163141236 Bug: 172541864 Signed-off-by: Alistair Delva <adelva@google.com> Change-Id: Ifbea109070650dfcb4f93a3cc692c18a8d11ab44
* | BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptrDmitry Safonov2020-11-02
| | | | | | | | | | | | | | | | | | | | | | | | | | Provide compat_xfrm_userpolicy_info translation for xfrm setsocketopt(). Reallocate buffer and put the missing padding for 64-bit message. Signed-off-by: Dmitry Safonov <dima@arista.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit 96392ee5a13b992563cfe07d23ee30d333b89126) [adelva: Edited around removed compat check in Android kernels] Bug: 163141236 Signed-off-by: Alistair Delva <adelva@google.com> Change-Id: I32a6495cd92fa13c956fca88aa5d80716155b8ae
* | BACKPORT: xfrm: Provide API to register translator moduleDmitry Safonov2020-11-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a skeleton for xfrm_compat module and provide API to register it in xfrm_state.ko. struct xfrm_translator will have function pointers to translate messages received from 32-bit userspace or to be sent to it from 64-bit kernel. module_get()/module_put() are used instead of rcu_read_lock() as the module will vmalloc() memory for translation. The new API is registered with xfrm_state module, not with xfrm_user as the former needs translator for user_policy set by setsockopt() and xfrm_user already uses functions from xfrm_state. Signed-off-by: Dmitry Safonov <dima@arista.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit c9e7c76d70fa50582ca96759829c93d0dd024662) [adelva: Edited around some context changes] Bug: 163141236 Signed-off-by: Alistair Delva <adelva@google.com> Change-Id: Ic825c6a0367fa192cc3f7af6b7d2682ef8f9d58b
* | Merge 4.4.239 into android-4.4-pGreg Kroah-Hartman2020-10-14
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.239 gpio: tc35894: fix up tc35894 interrupt configuration Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config net: dec: de2104x: Increase receive ring size for Tulip rndis_host: increase sleep time in the query-response loop drivers/net/wan/lapbether: Make skb->protocol consistent with the header drivers/net/wan/hdlc: Set skb->protocol before transmitting nfs: Fix security label length not being reset clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate() i2c: cpm: Fix i2c_ram structure epoll: do not insert into poll queues until all sanity checks are done epoll: replace ->visited/visited_list with generation count epoll: EPOLL_CTL_ADD: close the race in decision to take fast path ep_create_wakeup_source(): dentry name can change under you... netfilter: ctnetlink: add a range check for l3/l4 protonum fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts Revert "ravb: Fixed to be able to unload modules" fbcon: Fix global-out-of-bounds read in fbcon_get_font() net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() usermodehelper: reset umask to default before executing user process platform/x86: thinkpad_acpi: initialize tp_nvram_state variable platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse driver core: Fix probe_count imbalance in really_probe() perf top: Fix stdio interface input handling with glibc 2.28+ sctp: fix sctp_auth_init_hmacs() error path team: set dev->needed_headroom in team_setup_by_port() net: team: fix memory leak in __team_options_register mtd: nand: Provide nand_cleanup() function to free NAND related resources xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate xfrm: clone whole liftime_cur structure in xfrm_do_migrate net: stmmac: removed enabling eee in EEE set callback xfrm: Use correct address family in xfrm_state_find bonding: set dev->needed_headroom in bond_setup_by_slave() rxrpc: Fix rxkad token xdr encoding rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() rxrpc: Fix server keyring leak net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails Linux 4.4.239 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iac33b64c570b076bdc997d9778628d2ffbc3fef0
| * xfrm: Use correct address family in xfrm_state_findHerbert Xu2020-10-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit e94ee171349db84c7cfdc5fefbebe414054d0924 ] The struct flowi must never be interpreted by itself as its size depends on the address family. Therefore it must always be grouped with its original family value. In this particular instance, the original family value is lost in the function xfrm_state_find. Therefore we get a bogus read when it's coupled with the wrong family which would occur with inter- family xfrm states. This patch fixes it by keeping the original family value. Note that the same bug could potentially occur in LSM through the xfrm_state_pol_flow_match hook. I checked the current code there and it seems to be safe for now as only secid is used which is part of struct flowi_common. But that API should be changed so that so that we don't get new bugs in the future. We could do that by replacing fl with just secid or adding a family field. Reported-by: syzbot+577fbac3145a6eb2e7a5@syzkaller.appspotmail.com Fixes: 48b8d78315bf ("[XFRM]: State selection update to use inner...") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
| * xfrm: clone whole liftime_cur structure in xfrm_do_migrateAntony Antony2020-10-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 8366685b2883e523f91e9816d7be371eb1144749 ] When we clone state only add_time was cloned. It missed values like bytes, packets. Now clone the all members of the structure. v1->v3: - use memcpy to copy the entire structure Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)") Signed-off-by: Antony Antony <antony.antony@secunet.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* | Merge 4.4.223 into android-4.4-pGreg Kroah-Hartman2020-05-11
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.223 mwifiex: fix PCIe register information for 8997 chipset drm/qxl: qxl_release use after free drm/qxl: qxl_release leak in qxl_draw_dirty_fb() staging: rtl8192u: Fix crash due to pointers being "confusing" usb: gadget: f_acm: Fix configfs attr name usb: gadged: pch_udc: get rid of redundant assignments usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock usb: gadget: udc: core: don't starve DMA resources MIPS: Fix macro typo MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 MIPS: smp-cps: Stop printing EJTAG exceptions to UART MIPS: scall: Handle seccomp filters which redirect syscalls MIPS: BMIPS: BMIPS5000 has I cache filing from D cache MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache MIPS: BMIPS: Pretty print BMIPS5200 processor name MIPS: Fix HTW config on XPA kernel without LPA enabled MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 MIPS: math-emu: Fix BC1{EQ,NE}Z emulation MIPS: Fix BC1{EQ,NE}Z return offset calculation MIPS: perf: Fix I6400 event numbers MIPS: KVM: Fix translation of MFC0 ErrCtl MIPS: SMP: Update cpu_foreign_map on CPU disable MIPS: c-r4k: Fix protected_writeback_scache_line for EVA MIPS: Octeon: Off by one in octeon_irq_gpio_map() bpf, mips: fix off-by-one in ctx offset allocation MIPS: RM7000: Double locking bug in rm7k_tc_disable() MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO mips/panic: replace smp_send_stop() with kdump friendly version in panic path ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz ARM: imx: select SRC for i.MX7 ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl ARM: dts: kirkwood: use unique machine name for ds112 ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence perf/x86: Fix filter_events() bug with event mappings x86/LDT: Print the real LDT base address x86/apic/uv: Silence a shift wrapping warning ALSA: fm801: explicitly free IRQ line ALSA: fm801: propagate TUNER_ONLY bit when autodetected ALSA: fm801: detect FM-only card earlier netfilter: nfnetlink: use original skbuff when acking batches xfrm: fix crash in XFRM_MSG_GETSA netlink handler mwifiex: fix IBSS data path issue. mwifiex: add missing check for PCIe8997 chipset iwlwifi: set max firmware version of 7265 to 17 Bluetooth: btmrvl: fix hung task warning dump dccp: limit sk_filter trim to payload net/mlx4_core: Do not BUG_ON during reset when PCI is offline mlxsw: pci: Correctly determine if descriptor queue is full PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() net/mlx4_core: Implement pci_resume callback alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO vfio/pci: Allow VPD short read brcmfmac: add eth_type_trans back for PCIe full dongle mlxsw: Treat local port 64 as valid IB/mlx4: Initialize hop_limit when creating address handle ovs/gre,geneve: fix error path when creating an iface GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU powerpc/pci/of: Parse unassigned resources firmware: actually return NULL on failed request_firmware_nowait() c8sectpfe: Rework firmware loading mechanism net/mlx5: Avoid passing dma address 0 to firmware IB/mlx5: Fix RC transport send queue overhead computation net/mlx5: Make command timeout way shorter IB/mlx5: Fix FW version diaplay in sysfs net/mlx5e: Fix MLX5E_100BASE_T define net/mlx5: Fix the size of modify QP mailbox net/mlx5: Fix masking of reserved bits in XRCD number net/mlx5e: Fix blue flame quota logic net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create net/mlx5: Avoid calling sleeping function by the health poll thread net/mlx5: Fix wait_vital for VFs and remove fixed sleep net/mlx5: Fix potential deadlock in command mode change net/mlx5: Add timeout handle to commands with callback net/mlx5: Fix pci error recovery flow net/mlx5e: Copy all L2 headers into inline segment net_sched: keep backlog updated with qlen sch_drr: update backlog as well sch_hfsc: always keep backlog updated sch_prio: update backlog as well sch_qfq: keep backlog updated with qlen sch_sfb: keep backlog updated with qlen sch_tbf: update backlog as well btrfs: cleaner_kthread() doesn't need explicit freeze irda: Free skb on irda_accept error path. phy: fix device reference leaks bonding: prevent out of bound accesses mtd: nand: fix ONFI parameter page layout ath10k: free cached fw bin contents when get board id fails xprtrdma: checking for NULL instead of IS_ERR() xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) xprtrdma: xprt_rdma_free() must not release backchannel reqs xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len RDMA/cxgb3: device driver frees DMA memory with different size mlxsw: spectrum: Don't forward packets when STP state is DISABLED mlxsw: spectrum: Disable learning according to STP state mlxsw: spectrum: Don't count internal TX header bytes to stats mlxsw: spectrum: Indicate support for autonegotiation mlxsw: spectrum: Fix misuse of hard_header_len net: tcp_memcontrol: properly detect ancestor socket pressure tcp: do not set rtt_min to 1 RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock net: ipv6: tcp reset, icmp need to consider L3 domain batman-adv: Fix lockdep annotation of batadv_tlv_container_remove batman-adv: replace WARN with rate limited output on non-existing VLAN tty: serial: msm: Support more bauds serial: samsung: Fix possible out of bounds access on non-DT platform Drivers: hv: utils: use memdup_user in hvt_op_write isa: Call isa_bus_init before dependent ISA bus drivers register Btrfs: clean up an error code in btrfs_init_space_info() Input: gpio-keys - fix check for disabling unsupported keys Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key xfrm_user: propagate sec ctx allocation errors xfrm: Fix memory leak of aead algorithm name mac80211: fix mgmt-tx abort cookie and leak mac80211: TDLS: always downgrade invalid chandefs mac80211: TDLS: change BW calculation for WIDER_BW peers mac80211: Fix BW upgrade for TDLS peers NFS: Fix an LOCK/OPEN race when unlinking an open file net: get rid of an signed integer overflow in ip_idents_reserve() mtd: nand: denali: add missing nand_release() call in denali_remove() ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld() ASoC: tegra_alc5632: check return value ASoC: fsl_ssi: mark SACNT register volatile Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()" mmc: sdhci: restore behavior when setting VDD via external regulator mmc: sd: limit SD card power limit according to cards capabilities mmc: debugfs: correct wrong voltage value mmc: block: return error on failed mmc_blk_get() clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization" mmc: dw_mmc: rockchip: Set the drive phase properly mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type mmc: sdhci: Fix regression setting power on Trats2 board perf tools: Fix perf regs mask generation powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() powerpc/book3s: Fix MCE console messages for unrecoverable MCE. sctp: fix the transports round robin issue when init is retransmitted sunrpc: Update RPCBIND_MAXNETIDLEN NFC: nci: memory leak in nci_core_conn_create() net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS net: phy: Fix phy_mac_interrupt() net: phy: bcm7xxx: Fix shadow mode 2 disabling of_mdio: fix node leak in of_phy_register_fixed_link error path phy: micrel: Fix finding PHY properties in MAC node for KSZ9031. net: dsa: slave: fix of-node leak and phy priority drivers: net: cpsw: don't ignore phy-mode if phy-handle is used iommu/dma: Respect IOMMU aperture when allocating mdio-sun4i: oops in error handling in probe iio:ad7797: Use correct attribute_group selftests/ipc: Fix test failure seen after initial test run wimax/i2400m: Fix potential urb refcnt leak cifs: protect updating server->dstaddr with a spinlock scripts/config: allow colons in option strings for sed lib/mpi: Fix building for powerpc with clang net: bcmgenet: suppress warnings on failed Rx SKB allocations net: systemport: suppress warnings on failed Rx SKB allocations rc: allow rc modules to be loaded if rc-main is not a module lirc_imon: do not leave imon_probe() with mutex held am437x-vpfe: fix an uninitialized variable bug cx23885: uninitialized variable in cx23885_av_work_handler() ath9k_htc: check for underflow in ath9k_htc_rx_msg() VFIO: platform: reset: fix a warning message condition net: moxa: fix an error code mfd: lp8788-irq: Uninitialized variable in irq handler ethernet: micrel: fix some error codes power: ipaq-micro-battery: freeing the wrong variable i40e: fix an uninitialized variable bug qede: uninitialized variable in qede_start_xmit() qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() target: Fix a memory leak in target_dev_lba_map_store() memory/tegra: Add number of TLB lines for Tegra124 pinctrl: bcm2835: Fix memory leak in error path be2net: Don't leak iomapped memory on removal. ipv4: Fix memory leak in exception case for splitting tries flow_dissector: Check for IP fragmentation even if not using IPv4 address ipv4: fix checksum annotation in udp4_csum_init ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf() ipv4: accept u8 in IP_TOS ancillary data net: vrf: Fix dev refcnt leak due to IPv6 prefix route ipv6: fix checksum annotation in udp6_csum_init ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() ipv6: add missing netconf notif when 'all' is updated net: ipv6: Fix processing of RAs in presence of VRF netfilter: nf_tables: fix a wrong check to skip the inactive rules netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled netfilter: nf_tables: destroy the set if fail to add transaction netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it udp: restore UDPlite many-cast delivery clk: st: avoid uninitialized variable use clk: gpio: handle error codes for of_clk_get_parent_count() clk: ti: omap3+: dpll: use non-locking version of clk_get_rate clk: multiplier: Prevent the multiplier from under / over flowing clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit clk: xgene: Don't call __pa on ioremaped address cls_bpf: reset class and reuse major in da arm64: bpf: jit JMP_JSET_{X,K} bpf, trace: check event type in bpf_perf_event_read bpf: fix map not being uncharged during map creation failure net/mlx4_core: Fix potential corruption in counters database net/mlx4_core: Fix access to uninitialized index net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill net/mlx4_core: Check device state before unregistering it net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec net/mlx4_en: Process all completions in RX rings after port goes up net/mlx4_core: Do not access comm channel if it has not yet been initialized net/mlx4_en: Fix potential deadlock in port statistics flow net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering net/mlx4_core: Fix QUERY FUNC CAP flags mlxsw: switchx2: Fix misuse of hard_header_len mlxsw: switchx2: Fix ethernet port initialization sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion net_sched: flower: Avoid dissection of unmasked keys pkt_sched: fq: use proper locking in fq_dump_stats() sched/preempt: Fix preempt_count manipulations power: bq27xxx: fix reading for bq27000 and bq27010 power: bq27xxx: fix register numbers of bq27500 power: test_power: correctly handle empty writes power: bq27xxx_battery: Fix bq27541 AveragePower register address power_supply: tps65217-charger: Fix NULL deref during property export net: vrf: Fix dst reference counting net: Don't delete routes in different VRFs vti6: fix input path ipv4: Fix table id reference in fib_sync_down_addr mlx4: do not call napi_schedule() without care xprtrdma: Fix backchannel allocation of extra rpcrdma_reps ALSA: fm801: Initialize chip after IRQ handler is registered bonding: fix length of actor system MIPS: perf: Remove incorrect odd/even counter handling for I6400 Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT" net: dsa: mv88e6xxx: unlock DSA and CPU ports gfs2: fix flock panic issue blk-mq: fix undefined behaviour in order_to_size() dm: fix second blk_delay_queue() parameter to be in msec units not jiffies dmaengine: edma: Add probe callback to edma_tptc_driver openvswitch: update checksum in {push,pop}_mpls cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled net: bcmgenet: fix skb_len in bcmgenet_xmit_single() net: bcmgenet: device stats are unsigned long ovs/gre: fix rtnl notifications on iface deletion gre: do not assign header_ops in collect metadata mode gre: build header correctly for collect metadata tunnels gre: reject GUE and FOU in collect metadata mode sfc: fix potential stack corruption from running past stat bitmask sfc: clear napi_hash state when copying channels net: bcmsysport: Device stats are unsigned long cxgbi: fix uninitialized flowi6 net: macb: add missing free_netdev() on error in macb_probe() macvtap: segmented packet is consumed tipc: fix the error handling in tipc_udp_enable() net: icmp6_send should use dst dev to determine L3 domain et131x: Fix logical vs bitwise check in et131x_tx_timeout() net: ethernet: stmmac: dwmac-sti: fix probe error path rtnl: reset calcit fptr in rtnl_unregister() net: ethernet: stmmac: dwmac-rk: fix probe error path fq_codel: return non zero qlen in class dumps net: ethernet: stmmac: dwmac-generic: fix probe error path ovs/geneve: fix rtnl notifications on iface deletion bnxt: add a missing rcu synchronization qdisc: fix a module refcount leak in qdisc_create_dflt() net: axienet: Fix return value check in axienet_probe() bnxt_en: Remove locking around txr->dev_state net: ethernet: davinci_emac: Fix devioctl while in fixed link net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented net: ethernet: ti: cpsw: fix device and of_node leaks net: ethernet: ti: cpsw: fix secondary-emac probe error path net: hns: fix device reference leaks net: bridge: don't increment tx_dropped in br_do_proxy_arp net: dsa: mv88e6xxx: enable SA learning on DSA ports net: ehea: avoid null pointer dereference l2tp: fix use-after-free during module unload hwrng: exynos - Disable runtime PM on driver unbind net: icmp_route_lookup should use rt dev to determine L3 domain net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats net: macb: replace macb_writel() call by queue_writel() to update queue ISR ravb: Add missing free_irq() call to ravb_close() mvpp2: use correct size for memset net: vxlan: lwt: Fix vxlan local traffic. net: ethoc: Fix early error paths ovs/vxlan: fix rtnl notifications on iface deletion net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets. regulator: core: Rely on regulator_dev_release to free constraints net: dsa: mv88e6xxx: fix port VLAN maps at803x: fix reset handling cxl: Fix DAR check & use REGION_ID instead of opencoding net: ethernet: davinci_emac: Fix platform_data overwrite ata: sata_dwc_460ex: remove incorrect locking pinctrl: tegra: Correctly check the supported configuration brcmfmac: add fallback for devices that do not report per-chain values brcmfmac: restore stopping netdev queue when bus clogs up bridge: Fix problems around fdb entries pointing to the bridge device bna: add missing per queue ethtool stat net: skbuff: Remove errornous length validation in skb_vlan_pop() net: ep93xx_eth: Do not crash unloading module macvlan: Fix potential use-after free for broadcasts sctp: Fix SHUTDOWN CTSN Ack in the peer restart case ALSA: hda: Match both PCI ID and SSID for driver blacklist mac80211: add ieee80211_is_any_nullfunc() Linux 4.4.223 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie7caca39501fe5e82b947964cc474ed1c786d756
| * xfrm: Fix memory leak of aead algorithm nameIlan Tayari2020-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit b588479358ce26f32138e0f0a7ab0678f8e3e601 upstream. commit 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms") introduced aead. The function attach_aead kmemdup()s the algorithm name during xfrm_state_construct(). However this memory is never freed. Implementation has since been slightly modified in commit ee5c23176fcc ("xfrm: Clone states properly on migration") without resolving this leak. This patch adds a kfree() call for the aead algorithm name. Fixes: 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms") Signed-off-by: Ilan Tayari <ilant@mellanox.com> Acked-by: Rami Rosen <roszenrami@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | BACKPORT: xfrm: Allow Output Mark to be Updated Using UPDSABenedict Wong2020-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow UPDSA to change "output mark" to permit policy separation of packet routing decisions from SA keying in systems that use mark-based routing. The set mark, used as a routing and firewall mark for outbound packets, is made update-able which allows routing decisions to be handled independently of keying/SA creation. To maintain consistency with other optional attributes, the output mark is only updated if sent with a non-zero value. The per-SA lock and the xfrm_state_lock are taken in that order to avoid a deadlock with xfrm_timer_handler(), which also takes the locks in that order. Signed-off-by: Nathan Harold <nharold@google.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit 6d8e85ffe17895d7bc632dfbaa9e2e33b22fe873) Backport resolution required using props.output_mark instead of props.smark Change-Id: I08c7bfc114ac9826a8a18f5ac1c3ff17a4e0940b Signed-off-by: Benedict Wong <benedictwong@google.com> Bug: 114060045
* | Merge 4.4.193 into android-4.4-pGreg Kroah-Hartman2019-09-16
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes in 4.4.193 ALSA: hda - Fix potential endless loop at applying quirks ALSA: hda/realtek - Fix overridden device-specific initialization xfrm: clean up xfrm protocol checks vhost/test: fix build for vhost test scripts/decode_stacktrace: match basepath using shell prefix operator, not regex clk: s2mps11: Add used attribute to s2mps11_dt_match x86, boot: Remove multiple copy of static function sanitize_boot_params() af_packet: tone down the Tx-ring unsupported spew. vhost: make sure log_num < in_num Linux 4.4.193 Change-Id: If2283bf8bc29f3deaf1c047c8ec9e502fbdf0521 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
| * xfrm: clean up xfrm protocol checksCong Wang2019-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 upstream. In commit 6a53b7593233 ("xfrm: check id proto in validate_tmpl()") I introduced a check for xfrm protocol, but according to Herbert IPSEC_PROTO_ANY should only be used as a wildcard for lookup, so it should be removed from validate_tmpl(). And, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific protocols, this is why xfrm_state_flush() could still miss IPPROTO_ROUTING, which leads that those entries are left in net->xfrm.state_all before exit net. Fix this by replacing IPSEC_PROTO_ANY with zero. This patch also extracts the check from validate_tmpl() to xfrm_id_proto_valid() and uses it in parse_ipsecrequest(). With this, no other protocols should be added into xfrm. Fixes: 6a53b7593233 ("xfrm: check id proto in validate_tmpl()") Reported-by: syzbot+0bf0519d6e0de15914fe@syzkaller.appspotmail.com Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Zubin Mithra <zsm@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | ANDROID: xfrm: remove in_compat_syscall() checksTri Vo2019-07-29
|/ | | | | | | | | This hack is needed to run 32-bit userspace on 64-bit kernel. Bug: 138147164 Test: kernel_net_tests Signed-off-by: Tri Vo <trong@google.com> Change-Id: I083d32b45ca985cfadfe3ce57d253b63202befde
* xfrm: Fix bucket count reported to userspaceBenjamin Poirier2019-01-13
| | | | | | | | | | | | [ Upstream commit ca92e173ab34a4f7fc4128bd372bd96f1af6f507 ] sadhcnt is reported by `ip -s xfrm state count` as "buckets count", not the hash mask. Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.") Signed-off-by: Benjamin Poirier <bpoirier@suse.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* xfrm: Clear sk_dst_cache when applying per-socket policy.Jonathan Basseri2018-11-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 ] If a socket has a valid dst cache, then xfrm_lookup_route will get skipped. However, the cache is not invalidated when applying policy to a socket (i.e. IPV6_XFRM_POLICY). The result is that new policies are sometimes ignored on those sockets. (Note: This was broken for IPv4 and IPv6 at different times.) This can be demonstrated like so, 1. Create UDP socket. 2. connect() the socket. 3. Apply an outbound XFRM policy to the socket. (setsockopt) 4. send() data on the socket. Packets will continue to be sent in the clear instead of matching an xfrm or returning a no-match error (EAGAIN). This affects calls to send() and not sendto(). Invalidating the sk_dst_cache is necessary to correctly apply xfrm policies. Since we do this in xfrm_user_policy(), the sk_lock was already acquired in either do_ip_setsockopt() or do_ipv6_setsockopt(), and we may call __sk_dst_reset(). Performance impact should be negligible, since this code is only called when changing xfrm policy, and only affects the socket in question. Fixes: 00bc0ef5880d ("ipv6: Skip XFRM lookup if dst_entry in socket cache is valid") Tested: https://android-review.googlesource.com/517555 Tested: https://android-review.googlesource.com/418659 Signed-off-by: Jonathan Basseri <misterikkit@google.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
* xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)Antony Antony2018-05-26
| | | | | | | | | | | | | | | | | | | | | | | | commit 75bf50f4aaa1c78d769d854ab3d975884909e4fb upstream. copy geniv when cloning the xfrm state. x->geniv was not copied to the new state and migration would fail. xfrm_do_migrate .. xfrm_state_clone() .. .. esp_init_aead() crypto_alloc_aead() crypto_alloc_tfm() crypto_find_alg() return EAGAIN and failed Signed-off-by: Antony Antony <antony@phenome.org> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* xfrm: fix state migration copy replay sequence numbersAntony Antony2018-04-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit a486cd23661c9387fb076c3f6ae8b2aa9d20d54a ] During xfrm migration copy replay and preplay sequence numbers from the previous state. Here is a tcpdump output showing the problem. 10.0.10.46 is running vanilla kernel, is the IKE/IPsec responder. After the migration it sent wrong sequence number, reset to 1. The migration is from 10.0.0.52 to 10.0.0.53. IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7cf), length 136 IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7cf), length 136 IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d0), length 136 IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7d0), length 136 IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I] IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R] IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I] IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R] IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d1), length 136 NOTE: next sequence is wrong 0x1 IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x1), length 136 IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d2), length 136 IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x2), length 136 Signed-off-by: Antony Antony <antony@phenome.org> Reviewed-by: Richard Guy Briggs <rgb@tricolour.ca> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systemsSteffen Klassert2018-04-08
| | | | | | | | | | | | | | | | commit 19d7df69fdb2636856dc8919de72fc1bf8f79598 upstream. We don't have a compat layer for xfrm, so userspace and kernel structures have different sizes in this case. This results in a broken configuration, so refuse to configure socket policies when trying to insert from 32 bit userspace as we do it already with policies inserted via netlink. Reported-and-tested-by: syzbot+e1a1577ca8bcb47b769a@syzkaller.appspotmail.com Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> [use is_compat_task() - gregkh] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* net: xfrm: allow clearing socket xfrm policies.Lorenzo Colitti2018-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit be8f8284cd897af2482d4e54fbc2bdfc15557259 ] Currently it is possible to add or update socket policies, but not clear them. Therefore, once a socket policy has been applied, the socket cannot be used for unencrypted traffic. This patch allows (privileged) users to clear socket policies by passing in a NULL pointer and zero length argument to the {IP,IPV6}_{IPSEC,XFRM}_POLICY setsockopts. This results in both the incoming and outgoing policies being cleared. The simple approach taken in this patch cannot clear socket policies in only one direction. If desired this could be added in the future, for example by continuing to pass in a length of zero (which currently is guaranteed to return EMSGSIZE) and making the policy be a pointer to an integer that contains one of the XFRM_POLICY_{IN,OUT} enum values. An alternative would have been to interpret the length as a signed integer and use XFRM_POLICY_IN (i.e., 0) to clear the input policy and -XFRM_POLICY_OUT (i.e., -1) to clear the output policy. Tested: https://android-review.googlesource.com/539816 Signed-off-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2015-06-01
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: drivers/net/phy/amd-xgbe-phy.c drivers/net/wireless/iwlwifi/Kconfig include/net/mac80211.h iwlwifi/Kconfig and mac80211.h were both trivial overlapping changes. The drivers/net/phy/amd-xgbe-phy.c file got removed in 'net-next' and the bug fix that happened on the 'net' side is already integrated into the rest of the amd-xgbe driver. Signed-off-by: David S. Miller <davem@davemloft.net>
| * xfrm: fix a race in xfrm_state_lookup_byspiLi RongQing2015-04-29
| | | | | | | | | | | | | | | | | | | | | | The returned xfrm_state should be hold before unlock xfrm_state_lock, otherwise the returned xfrm_state maybe be released. Fixes: c454997e6[{pktgen, xfrm} Introduce xfrm_state_lookup_byspi..] Cc: Fan Du <fan.du@intel.com> Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Acked-by: Fan Du <fan.du@intel.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | xfrm: fix the return code when xfrm_*_register_afinfo failedLi RongQing2015-04-23
| | | | | | | | | | | | | | | | If xfrm_*_register_afinfo failed since xfrm_*_afinfo[afinfo->family] had the value, return the -EEXIST, not -ENOBUFS Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | xfrm: optimise the use of walk list header in xfrm_policy/state_walkLi RongQing2015-04-23
|/ | | | | | | | | | | | The walk from input is the list header, and marked as dead, and will be skipped in loop. list_first_entry() can be used to return the true usable value from walk if walk is not empty Signed-off-by: Li RongQing <roy.qing.li@gmail.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* xfrm: simplify xfrm_address_t useJiri Benc2015-03-31
| | | | | | | | | | | In many places, the a6 field is typecasted to struct in6_addr. As the fields are in union anyway, just add in6_addr type to the union and get rid of the typecasting. Modifying the uapi header is okay, the union has still the same size. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* xfrm: remove useless hash_resize_mutex locksYing Xue2014-08-29
| | | | | | | | | | | | | | | | | | | In xfrm_state.c, hash_resize_mutex is defined as a local variable and only used in xfrm_hash_resize() which is declared as a work handler of xfrm.state_hash_work. But when the xfrm.state_hash_work work is put in the global workqueue(system_wq) with schedule_work(), the work will be really inserted in the global workqueue if it was not already queued, otherwise, it is still left in the same position on the the global workqueue. This means the xfrm_hash_resize() work handler is only executed once at any time no matter how many times its work is scheduled, that is, xfrm_hash_resize() is not called concurrently at all, so hash_resize_mutex is redundant for us. Cc: Christophe Gouault <christophe.gouault@6wind.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Ying Xue <ying.xue@windriver.com> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* xfrm: Remove useless xfrm_audit struct.Tetsuo Handa2014-04-23
| | | | | | | | | | | | | Commit f1370cc4 "xfrm: Remove useless secid field from xfrm_audit." changed "struct xfrm_audit" to have either { audit_get_loginuid(current) / audit_get_sessionid(current) } or { INVALID_UID / -1 } pair. This means that we can represent "struct xfrm_audit" as "bool". This patch replaces "struct xfrm_audit" argument with "bool". Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* xfrm: Remove useless secid field from xfrm_audit.Tetsuo Handa2014-04-22
| | | | | | | | | | | | | | | | | | | | | | | | | It seems to me that commit ab5f5e8b "[XFRM]: xfrm audit calls" is doing something strange at xfrm_audit_helper_usrinfo(). If secid != 0 && security_secid_to_secctx(secid) != 0, the caller calls audit_log_task_context() which basically does secid != 0 && security_secid_to_secctx(secid) == 0 case except that secid is obtained from current thread's context. Oh, what happens if secid passed to xfrm_audit_helper_usrinfo() was obtained from other thread's context? It might audit current thread's context rather than other thread's context if security_secid_to_secctx() in xfrm_audit_helper_usrinfo() failed for some reason. Then, are all the caller of xfrm_audit_helper_usrinfo() passing either secid obtained from current thread's context or secid == 0? It seems to me that they are. If I didn't miss something, we don't need to pass secid to xfrm_audit_helper_usrinfo() because audit_log_task_context() will obtain secid from current thread's context. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* Merge branch 'master' of ↵David S. Miller2014-03-18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== One patch to rename a newly introduced struct. The rest is the rework of the IPsec virtual tunnel interface for ipv6 to support inter address family tunneling and namespace crossing. 1) Rename the newly introduced struct xfrm_filter to avoid a conflict with iproute2. From Nicolas Dichtel. 2) Introduce xfrm_input_afinfo to access the address family dependent tunnel callback functions properly. 3) Add and use a IPsec protocol multiplexer for ipv6. 4) Remove dst_entry caching. vti can lookup multiple different dst entries, dependent of the configured xfrm states. Therefore it does not make to cache a dst_entry. 5) Remove caching of flow informations. vti6 does not use the the tunnel endpoint addresses to do route and xfrm lookups. 6) Update the vti6 to use its own receive hook. 7) Remove the now unused xfrm_tunnel_notifier. This was used from vti and is replaced by the IPsec protocol multiplexer hooks. 8) Support inter address family tunneling for vti6. 9) Check if the tunnel endpoints of the xfrm state and the vti interface are matching and return an error otherwise. 10) Enable namespace crossing for vti devices. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * xfrm: rename struct xfrm_filterNicolas Dichtel2014-03-07
| | | | | | | | | | | | | | | | | | iproute2 already defines a structure with that name, let's use another one to avoid any conflict. CC: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller2014-03-05
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: drivers/net/wireless/ath/ath9k/recv.c drivers/net/wireless/mwifiex/pcie.c net/ipv6/sit.c The SIT driver conflict consists of a bug fix being done by hand in 'net' (missing u64_stats_init()) whilst in 'net-next' a helper was created (netdev_alloc_pcpu_stats()) which takes care of this. The two wireless conflicts were overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net>
| * xfrm: Clone states properly on migrationSteffen Klassert2014-02-20
| | | | | | | | | | | | | | | | | | | | We loose a lot of information of the original state if we clone it with xfrm_state_clone(). In particular, there is no crypto algorithm attached if the original state uses an aead algorithm. This patch add the missing information to the clone state. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: Take xfrm_state_lock in xfrm_migrate_state_findSteffen Klassert2014-02-20
| | | | | | | | | | | | | | | | A comment on xfrm_migrate_state_find() says that xfrm_state_lock is held. This is apparently not the case, but we need it to traverse through the state lists. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: Fix NULL pointer dereference on sub policy usageSteffen Klassert2014-02-20
| | | | | | | | | | | | | | | | | | | | xfrm_state_sort() takes the unsorted states from the src array and stores them into the dst array. We try to get the namespace from the dst array which is empty at this time, so take the namespace from the src array instead. Fixes: 283bc9f35bbbc ("xfrm: Namespacify xfrm state/policy locks") Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | xfrm: Cleanup error handling of xfrm_state_cloneSteffen Klassert2014-02-21
| | | | | | | | | | | | | | The error pointer passed to xfrm_state_clone() is unchecked, so remove it and indicate an error by returning a null pointer. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | ipsec: add support of limited SA dumpNicolas Dichtel2014-02-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The goal of this patch is to allow userland to dump only a part of SA by specifying a filter during the dump. The kernel is in charge to filter SA, this avoids to generate useless netlink traffic (it save also some cpu cycles). This is particularly useful when there is a big number of SA set on the system. Note that I removed the union in struct xfrm_state_walk to fix a problem on arm. struct netlink_callback->args is defined as a array of 6 long and the first long is used in xfrm code to flag the cb as initialized. Hence, we must have: sizeof(struct xfrm_state_walk) <= sizeof(long) * 5. With the union, it was false on arm (sizeof(struct xfrm_state_walk) was sizeof(long) * 7), due to the padding. In fact, whatever the arch is, this union seems useless, there will be always padding after it. Removing it will not increase the size of this struct (and reduce it on arm). Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | xfrm: avoid creating temporary SA when there are no listenersHoria Geanta2014-02-13
|/ | | | | | | | | | | | | | In the case when KMs have no listeners, km_query() will fail and temporary SAs are garbage collected immediately after their allocation. This causes strain on memory allocation, leading even to OOM since temporary SA alloc/free cycle is performed for every packet and garbage collection does not keep up the pace. The sane thing to do is to make sure we have audience before temporary SA allocation. Signed-off-by: Horia Geanta <horia.geanta@freescale.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-nextLinus Torvalds2014-01-25
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull networking updates from David Miller: 1) BPF debugger and asm tool by Daniel Borkmann. 2) Speed up create/bind in AF_PACKET, also from Daniel Borkmann. 3) Correct reciprocal_divide and update users, from Hannes Frederic Sowa and Daniel Borkmann. 4) Currently we only have a "set" operation for the hw timestamp socket ioctl, add a "get" operation to match. From Ben Hutchings. 5) Add better trace events for debugging driver datapath problems, also from Ben Hutchings. 6) Implement auto corking in TCP, from Eric Dumazet. Basically, if we have a small send and a previous packet is already in the qdisc or device queue, defer until TX completion or we get more data. 7) Allow userspace to manage ipv6 temporary addresses, from Jiri Pirko. 8) Add a qdisc bypass option for AF_PACKET sockets, from Daniel Borkmann. 9) Share IP header compression code between Bluetooth and IEEE802154 layers, from Jukka Rissanen. 10) Fix ipv6 router reachability probing, from Jiri Benc. 11) Allow packets to be captured on macvtap devices, from Vlad Yasevich. 12) Support tunneling in GRO layer, from Jerry Chu. 13) Allow bonding to be configured fully using netlink, from Scott Feldman. 14) Allow AF_PACKET users to obtain the VLAN TPID, just like they can already get the TCI. From Atzm Watanabe. 15) New "Heavy Hitter" qdisc, from Terry Lam. 16) Significantly improve the IPSEC support in pktgen, from Fan Du. 17) Allow ipv4 tunnels to cache routes, just like sockets. From Tom Herbert. 18) Add Proportional Integral Enhanced packet scheduler, from Vijay Subramanian. 19) Allow openvswitch to mmap'd netlink, from Thomas Graf. 20) Key TCP metrics blobs also by source address, not just destination address. From Christoph Paasch. 21) Support 10G in generic phylib. From Andy Fleming. 22) Try to short-circuit GRO flow compares using device provided RX hash, if provided. From Tom Herbert. The wireless and netfilter folks have been busy little bees too. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2064 commits) net/cxgb4: Fix referencing freed adapter ipv6: reallocate addrconf router for ipv6 address when lo device up fib_frontend: fix possible NULL pointer dereference rtnetlink: remove IFLA_BOND_SLAVE definition rtnetlink: remove check for fill_slave_info in rtnl_have_link_slave_info qlcnic: update version to 5.3.55 qlcnic: Enhance logic to calculate msix vectors. qlcnic: Refactor interrupt coalescing code for all adapters. qlcnic: Update poll controller code path qlcnic: Interrupt code cleanup qlcnic: Enhance Tx timeout debugging. qlcnic: Use bool for rx_mac_learn. bonding: fix u64 division rtnetlink: add missing IFLA_BOND_AD_INFO_UNSPEC sfc: Use the correct maximum TX DMA ring size for SFC9100 Add Shradha Shah as the sfc driver maintainer. net/vxlan: Share RX skb de-marking and checksum checks with ovs tulip: cleanup by using ARRAY_SIZE() ip_tunnel: clear IPCB in ip_tunnel_xmit() in case dst_link_failure() is called net/cxgb4: Don't retrieve stats during recovery ...
| * net: replace macros net_random and net_srandom with direct calls to prandomAruna-Hewapathirane2014-01-14
| | | | | | | | | | | | | | | | | | | | | | | | This patch removes the net_random and net_srandom macros and replaces them with direct calls to the prandom ones. As new commits only seem to use prandom_u32 there is no use to keep them around. This change makes it easier to grep for users of prandom_u32. Signed-off-by: Aruna-Hewapathirane <aruna.hewapathirane@gmail.com> Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
| * {pktgen, xfrm} Introduce xfrm_state_lookup_byspi for pktgenFan Du2014-01-03
| | | | | | | | | | | | | | | | | | | | Introduce xfrm_state_lookup_byspi to find user specified by custom from "pgset spi xxx". Using this scheme, any flow regardless its saddr/daddr could be transform by SA specified with configurable spi. Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * {pktgen, xfrm} Correct xfrm_state_lock usage in xfrm_stateonly_findFan Du2014-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Acquiring xfrm_state_lock in process context is expected to turn BH off, as this lock is also used in BH context, namely xfrm state timer handler. Otherwise it surprises LOCKDEP with below messages. [ 81.422781] pktgen: Packet Generator for packet performance testing. Version: 2.74 [ 81.725194] [ 81.725211] ========================================================= [ 81.725212] [ INFO: possible irq lock inversion dependency detected ] [ 81.725215] 3.13.0-rc2+ #92 Not tainted [ 81.725216] --------------------------------------------------------- [ 81.725218] kpktgend_0/2780 just changed the state of lock: [ 81.725220] (xfrm_state_lock){+.+...}, at: [<ffffffff816dd751>] xfrm_stateonly_find+0x41/0x1f0 [ 81.725231] but this lock was taken by another, SOFTIRQ-safe lock in the past: [ 81.725232] (&(&x->lock)->rlock){+.-...} [ 81.725232] [ 81.725232] and interrupts could create inverse lock ordering between them. [ 81.725232] [ 81.725235] [ 81.725235] other info that might help us debug this: [ 81.725237] Possible interrupt unsafe locking scenario: [ 81.725237] [ 81.725238] CPU0 CPU1 [ 81.725240] ---- ---- [ 81.725241] lock(xfrm_state_lock); [ 81.725243] local_irq_disable(); [ 81.725244] lock(&(&x->lock)->rlock); [ 81.725246] lock(xfrm_state_lock); [ 81.725248] <Interrupt> [ 81.725249] lock(&(&x->lock)->rlock); [ 81.725251] [ 81.725251] *** DEADLOCK *** [ 81.725251] [ 81.725254] no locks held by kpktgend_0/2780. [ 81.725255] [ 81.725255] the shortest dependencies between 2nd lock and 1st lock: [ 81.725269] -> (&(&x->lock)->rlock){+.-...} ops: 8 { [ 81.725274] HARDIRQ-ON-W at: [ 81.725276] [<ffffffff8109a64b>] __lock_acquire+0x65b/0x1d70 [ 81.725282] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725284] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725289] [<ffffffff816dc3a3>] xfrm_timer_handler+0x43/0x290 [ 81.725292] [<ffffffff81059437>] __tasklet_hrtimer_trampoline+0x17/0x40 [ 81.725300] [<ffffffff8105a1b7>] tasklet_hi_action+0xd7/0xf0 [ 81.725303] [<ffffffff81059ac6>] __do_softirq+0xe6/0x2d0 [ 81.725305] [<ffffffff8105a026>] irq_exit+0x96/0xc0 [ 81.725308] [<ffffffff8177fd0a>] smp_apic_timer_interrupt+0x4a/0x60 [ 81.725313] [<ffffffff8177e96f>] apic_timer_interrupt+0x6f/0x80 [ 81.725316] [<ffffffff8100b7c6>] arch_cpu_idle+0x26/0x30 [ 81.725329] [<ffffffff810ace28>] cpu_startup_entry+0x88/0x2b0 [ 81.725333] [<ffffffff8102e5b0>] start_secondary+0x190/0x1f0 [ 81.725338] IN-SOFTIRQ-W at: [ 81.725340] [<ffffffff8109a61d>] __lock_acquire+0x62d/0x1d70 [ 81.725342] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725344] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725347] [<ffffffff816dc3a3>] xfrm_timer_handler+0x43/0x290 [ 81.725349] [<ffffffff81059437>] __tasklet_hrtimer_trampoline+0x17/0x40 [ 81.725352] [<ffffffff8105a1b7>] tasklet_hi_action+0xd7/0xf0 [ 81.725355] [<ffffffff81059ac6>] __do_softirq+0xe6/0x2d0 [ 81.725358] [<ffffffff8105a026>] irq_exit+0x96/0xc0 [ 81.725360] [<ffffffff8177fd0a>] smp_apic_timer_interrupt+0x4a/0x60 [ 81.725363] [<ffffffff8177e96f>] apic_timer_interrupt+0x6f/0x80 [ 81.725365] [<ffffffff8100b7c6>] arch_cpu_idle+0x26/0x30 [ 81.725368] [<ffffffff810ace28>] cpu_startup_entry+0x88/0x2b0 [ 81.725370] [<ffffffff8102e5b0>] start_secondary+0x190/0x1f0 [ 81.725373] INITIAL USE at: [ 81.725375] [<ffffffff8109a31a>] __lock_acquire+0x32a/0x1d70 [ 81.725385] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725388] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725390] [<ffffffff816dc3a3>] xfrm_timer_handler+0x43/0x290 [ 81.725394] [<ffffffff81059437>] __tasklet_hrtimer_trampoline+0x17/0x40 [ 81.725398] [<ffffffff8105a1b7>] tasklet_hi_action+0xd7/0xf0 [ 81.725401] [<ffffffff81059ac6>] __do_softirq+0xe6/0x2d0 [ 81.725404] [<ffffffff8105a026>] irq_exit+0x96/0xc0 [ 81.725407] [<ffffffff8177fd0a>] smp_apic_timer_interrupt+0x4a/0x60 [ 81.725409] [<ffffffff8177e96f>] apic_timer_interrupt+0x6f/0x80 [ 81.725412] [<ffffffff8100b7c6>] arch_cpu_idle+0x26/0x30 [ 81.725415] [<ffffffff810ace28>] cpu_startup_entry+0x88/0x2b0 [ 81.725417] [<ffffffff8102e5b0>] start_secondary+0x190/0x1f0 [ 81.725420] } [ 81.725421] ... key at: [<ffffffff8295b9c8>] __key.46349+0x0/0x8 [ 81.725445] ... acquired at: [ 81.725446] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725449] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725452] [<ffffffff816dc057>] __xfrm_state_delete+0x37/0x140 [ 81.725454] [<ffffffff816dc18c>] xfrm_state_delete+0x2c/0x50 [ 81.725456] [<ffffffff816dc277>] xfrm_state_flush+0xc7/0x1b0 [ 81.725458] [<ffffffffa005f6cc>] pfkey_flush+0x7c/0x100 [af_key] [ 81.725465] [<ffffffffa005efb7>] pfkey_process+0x1c7/0x1f0 [af_key] [ 81.725468] [<ffffffffa005f139>] pfkey_sendmsg+0x159/0x260 [af_key] [ 81.725471] [<ffffffff8162c16f>] sock_sendmsg+0xaf/0xc0 [ 81.725476] [<ffffffff8162c99c>] SYSC_sendto+0xfc/0x130 [ 81.725479] [<ffffffff8162cf3e>] SyS_sendto+0xe/0x10 [ 81.725482] [<ffffffff8177dd12>] system_call_fastpath+0x16/0x1b [ 81.725484] [ 81.725486] -> (xfrm_state_lock){+.+...} ops: 11 { [ 81.725490] HARDIRQ-ON-W at: [ 81.725493] [<ffffffff8109a64b>] __lock_acquire+0x65b/0x1d70 [ 81.725504] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725507] [<ffffffff81774e4b>] _raw_spin_lock_bh+0x3b/0x70 [ 81.725510] [<ffffffff816dc1df>] xfrm_state_flush+0x2f/0x1b0 [ 81.725513] [<ffffffffa005f6cc>] pfkey_flush+0x7c/0x100 [af_key] [ 81.725516] [<ffffffffa005efb7>] pfkey_process+0x1c7/0x1f0 [af_key] [ 81.725519] [<ffffffffa005f139>] pfkey_sendmsg+0x159/0x260 [af_key] [ 81.725522] [<ffffffff8162c16f>] sock_sendmsg+0xaf/0xc0 [ 81.725525] [<ffffffff8162c99c>] SYSC_sendto+0xfc/0x130 [ 81.725527] [<ffffffff8162cf3e>] SyS_sendto+0xe/0x10 [ 81.725530] [<ffffffff8177dd12>] system_call_fastpath+0x16/0x1b [ 81.725533] SOFTIRQ-ON-W at: [ 81.725534] [<ffffffff8109a67a>] __lock_acquire+0x68a/0x1d70 [ 81.725537] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725539] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725541] [<ffffffff816dd751>] xfrm_stateonly_find+0x41/0x1f0 [ 81.725544] [<ffffffffa008af03>] mod_cur_headers+0x793/0x7f0 [pktgen] [ 81.725547] [<ffffffffa008bca2>] pktgen_thread_worker+0xd42/0x1880 [pktgen] [ 81.725550] [<ffffffff81078f84>] kthread+0xe4/0x100 [ 81.725555] [<ffffffff8177dc6c>] ret_from_fork+0x7c/0xb0 [ 81.725565] INITIAL USE at: [ 81.725567] [<ffffffff8109a31a>] __lock_acquire+0x32a/0x1d70 [ 81.725569] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725572] [<ffffffff81774e4b>] _raw_spin_lock_bh+0x3b/0x70 [ 81.725574] [<ffffffff816dc1df>] xfrm_state_flush+0x2f/0x1b0 [ 81.725576] [<ffffffffa005f6cc>] pfkey_flush+0x7c/0x100 [af_key] [ 81.725580] [<ffffffffa005efb7>] pfkey_process+0x1c7/0x1f0 [af_key] [ 81.725583] [<ffffffffa005f139>] pfkey_sendmsg+0x159/0x260 [af_key] [ 81.725586] [<ffffffff8162c16f>] sock_sendmsg+0xaf/0xc0 [ 81.725589] [<ffffffff8162c99c>] SYSC_sendto+0xfc/0x130 [ 81.725594] [<ffffffff8162cf3e>] SyS_sendto+0xe/0x10 [ 81.725597] [<ffffffff8177dd12>] system_call_fastpath+0x16/0x1b [ 81.725599] } [ 81.725600] ... key at: [<ffffffff81cadef8>] xfrm_state_lock+0x18/0x50 [ 81.725606] ... acquired at: [ 81.725607] [<ffffffff810995c0>] check_usage_backwards+0x110/0x150 [ 81.725609] [<ffffffff81099e96>] mark_lock+0x196/0x2f0 [ 81.725611] [<ffffffff8109a67a>] __lock_acquire+0x68a/0x1d70 [ 81.725614] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725616] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725627] [<ffffffff816dd751>] xfrm_stateonly_find+0x41/0x1f0 [ 81.725629] [<ffffffffa008af03>] mod_cur_headers+0x793/0x7f0 [pktgen] [ 81.725632] [<ffffffffa008bca2>] pktgen_thread_worker+0xd42/0x1880 [pktgen] [ 81.725635] [<ffffffff81078f84>] kthread+0xe4/0x100 [ 81.725637] [<ffffffff8177dc6c>] ret_from_fork+0x7c/0xb0 [ 81.725640] [ 81.725641] [ 81.725641] stack backtrace: [ 81.725645] CPU: 0 PID: 2780 Comm: kpktgend_0 Not tainted 3.13.0-rc2+ #92 [ 81.725647] Hardware name: innotek GmbH VirtualBox, BIOS VirtualBox 12/01/2006 [ 81.725649] ffffffff82537b80 ffff880018199988 ffffffff8176af37 0000000000000007 [ 81.725652] ffff8800181999f0 ffff8800181999d8 ffffffff81099358 ffffffff82537b80 [ 81.725655] ffffffff81a32def ffff8800181999f4 0000000000000000 ffff880002cbeaa8 [ 81.725659] Call Trace: [ 81.725664] [<ffffffff8176af37>] dump_stack+0x46/0x58 [ 81.725667] [<ffffffff81099358>] print_irq_inversion_bug.part.42+0x1e8/0x1f0 [ 81.725670] [<ffffffff810995c0>] check_usage_backwards+0x110/0x150 [ 81.725672] [<ffffffff81099e96>] mark_lock+0x196/0x2f0 [ 81.725675] [<ffffffff810994b0>] ? check_usage_forwards+0x150/0x150 [ 81.725685] [<ffffffff8109a67a>] __lock_acquire+0x68a/0x1d70 [ 81.725691] [<ffffffff810899a5>] ? sched_clock_local+0x25/0x90 [ 81.725694] [<ffffffff81089b38>] ? sched_clock_cpu+0xa8/0x120 [ 81.725697] [<ffffffff8109a31a>] ? __lock_acquire+0x32a/0x1d70 [ 81.725699] [<ffffffff816dd751>] ? xfrm_stateonly_find+0x41/0x1f0 [ 81.725702] [<ffffffff8109c3c7>] lock_acquire+0x97/0x130 [ 81.725704] [<ffffffff816dd751>] ? xfrm_stateonly_find+0x41/0x1f0 [ 81.725707] [<ffffffff810899a5>] ? sched_clock_local+0x25/0x90 [ 81.725710] [<ffffffff81774af6>] _raw_spin_lock+0x36/0x70 [ 81.725712] [<ffffffff816dd751>] ? xfrm_stateonly_find+0x41/0x1f0 [ 81.725715] [<ffffffff810971ec>] ? lock_release_holdtime.part.26+0x1c/0x1a0 [ 81.725717] [<ffffffff816dd751>] xfrm_stateonly_find+0x41/0x1f0 [ 81.725721] [<ffffffffa008af03>] mod_cur_headers+0x793/0x7f0 [pktgen] [ 81.725724] [<ffffffffa008bca2>] pktgen_thread_worker+0xd42/0x1880 [pktgen] [ 81.725727] [<ffffffffa008ba71>] ? pktgen_thread_worker+0xb11/0x1880 [pktgen] [ 81.725729] [<ffffffff8109cf9d>] ? trace_hardirqs_on+0xd/0x10 [ 81.725733] [<ffffffff81775410>] ? _raw_spin_unlock_irq+0x30/0x40 [ 81.725745] [<ffffffff8151faa0>] ? e1000_clean+0x9d0/0x9d0 [ 81.725751] [<ffffffff81094310>] ? __init_waitqueue_head+0x60/0x60 [ 81.725753] [<ffffffff81094310>] ? __init_waitqueue_head+0x60/0x60 [ 81.725757] [<ffffffffa008af60>] ? mod_cur_headers+0x7f0/0x7f0 [pktgen] [ 81.725759] [<ffffffff81078f84>] kthread+0xe4/0x100 [ 81.725762] [<ffffffff81078ea0>] ? flush_kthread_worker+0x170/0x170 [ 81.725765] [<ffffffff8177dc6c>] ret_from_fork+0x7c/0xb0 [ 81.725768] [<ffffffff81078ea0>] ? flush_kthread_worker+0x170/0x170 Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: checkpatch errors with foo * barWeilong Chen2014-01-02
| | | | | | | | | | | | | | | | | | This patch clean up some checkpatch errors like this: ERROR: "foo * bar" should be "foo *bar" ERROR: "(foo*)" should be "(foo *)" Signed-off-by: Weilong Chen <chenweilong@huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: checkpatch errors with spaceWeilong Chen2014-01-02
| | | | | | | | | | | | | | This patch cleanup some space errors. Signed-off-by: Weilong Chen <chenweilong@huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: export verify_userspi_info for pkfey and netlink interfaceFan Du2013-12-16
| | | | | | | | | | | | | | | | In order to check against valid IPcomp spi range, export verify_userspi_info for both pfkey and netlink interface. Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: Remove ancient sleeping when the SA is in acquire stateSteffen Klassert2013-12-06
| | | | | | | | | | | | | | | | We now queue packets to the policy if the states are not yet resolved, this replaces the ancient sleeping code. Also the sleeping can cause indefinite task hangs if the needed state does not get resolved. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| * xfrm: Namespacify xfrm state/policy locksFan Du2013-12-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By semantics, xfrm layer is fully name space aware, so will the locks, e.g. xfrm_state/pocliy_lock. Ensure exclusive access into state/policy link list for different name space with one global lock is not right in terms of semantics aspect at first place, as they are indeed mutually independent with each other, but also more seriously causes scalability problem. One practical scenario is on a Open Network Stack, more than hundreds of lxc tenants acts as routers within one host, a global xfrm_state/policy_lock becomes the bottleneck. But onces those locks are decoupled in a per-namespace fashion, locks contend is just with in specific name space scope, without causing additional SPD/SAD access delay for other name space. Also this patch improve scalability while as without changing original xfrm behavior. Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
* | Merge git://git.infradead.org/users/eparis/auditLinus Torvalds2014-01-23
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull audit update from Eric Paris: "Again we stayed pretty well contained inside the audit system. Venturing out was fixing a couple of function prototypes which were inconsistent (didn't hurt anything, but we used the same value as an int, uint, u32, and I think even a long in a couple of places). We also made a couple of minor changes to when a couple of LSMs called the audit system. We hoped to add aarch64 audit support this go round, but it wasn't ready. I'm disappearing on vacation on Thursday. I should have internet access, but it'll be spotty. If anything goes wrong please be sure to cc rgb@redhat.com. He'll make fixing things his top priority" * git://git.infradead.org/users/eparis/audit: (50 commits) audit: whitespace fix in kernel-parameters.txt audit: fix location of __net_initdata for audit_net_ops audit: remove pr_info for every network namespace audit: Modify a set of system calls in audit class definitions audit: Convert int limit uses to u32 audit: Use more current logging style audit: Use hex_byte_pack_upper audit: correct a type mismatch in audit_syscall_exit() audit: reorder AUDIT_TTY_SET arguments audit: rework AUDIT_TTY_SET to only grab spin_lock once audit: remove needless switch in AUDIT_SET audit: use define's for audit version audit: documentation of audit= kernel parameter audit: wait_for_auditd rework for readability audit: update MAINTAINERS audit: log task info on feature change audit: fix incorrect set of audit_sock audit: print error message when fail to create audit socket audit: fix dangling keywords in audit_log_set_loginuid() output audit: log on errors from filter user rules ...
| * audit: convert all sessionid declaration to unsigned intEric Paris2014-01-13
| | | | | | | | | | | | | | | | | | Right now the sessionid value in the kernel is a combination of u32, int, and unsigned int. Just use unsigned int throughout. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
* | xfrm: Simplify SA looking up when using wildcard sourceFan Du2013-10-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | __xfrm4/6_state_addr_check is a four steps check, all we need to do is checking whether the destination address match when looking SA using wildcard source address. Passing saddr from flow is worst option, as the checking needs to reach the fourth step while actually only one time checking will do the work. So, simplify this process by only checking destination address when using wildcard source address for looking up SAs. Signed-off-by: Fan Du <fan.du@windriver.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-22 20:34:56 +0000