aboutsummaryrefslogtreecommitdiffstats
path: root/scripts/genksyms (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2019-10-29tipc: improve throughput between nodes in netnsHoang Le8-11/+197
Currently, TIPC transports intra-node user data messages directly socket to socket, hence shortcutting all the lower layers of the communication stack. This gives TIPC very good intra node performance, both regarding throughput and latency. We now introduce a similar mechanism for TIPC data traffic across network namespaces located in the same kernel. On the send path, the call chain is as always accompanied by the sending node's network name space pointer. However, once we have reliably established that the receiving node is represented by a namespace on the same host, we just replace the namespace pointer with the receiving node/namespace's ditto, and follow the regular socket receive patch though the receiving node. This technique gives us a throughput similar to the node internal throughput, several times larger than if we let the traffic go though the full network stacks. As a comparison, max throughput for 64k messages is four times larger than TCP throughput for the same type of traffic. To meet any security concerns, the following should be noted. - All nodes joining a cluster are supposed to have been be certified and authenticated by mechanisms outside TIPC. This is no different for nodes/namespaces on the same host; they have to auto discover each other using the attached interfaces, and establish links which are supervised via the regular link monitoring mechanism. Hence, a kernel local node has no other way to join a cluster than any other node, and have to obey to policies set in the IP or device layers of the stack. - Only when a sender has established with 100% certainty that the peer node is located in a kernel local namespace does it choose to let user data messages, and only those, take the crossover path to the receiving node/namespace. - If the receiving node/namespace is removed, its namespace pointer is invalidated at all peer nodes, and their neighbor link monitoring will eventually note that this node is gone. - To ensure the "100% certainty" criteria, and prevent any possible spoofing, received discovery messages must contain a proof that the sender knows a common secret. We use the hash mix of the sending node/namespace for this purpose, since it can be accessed directly by all other namespaces in the kernel. Upon reception of a discovery message, the receiver checks this proof against all the local namespaces'hash_mix:es. If it finds a match, that, along with a matching node id and cluster id, this is deemed sufficient proof that the peer node in question is in a local namespace, and a wormhole can be opened. - We should also consider that TIPC is intended to be a cluster local IPC mechanism (just like e.g. UNIX sockets) rather than a network protocol, and hence we think it can justified to allow it to shortcut the lower protocol layers. Regarding traceability, we should notice that since commit 6c9081a3915d ("tipc: add loopback device tracking") it is possible to follow the node internal packet flow by just activating tcpdump on the loopback interface. This will be true even for this mechanism; by activating tcpdump on the involved nodes' loopback interfaces their inter-name space messaging can easily be tracked. v2: - update 'net' pointer when node left/rejoined v3: - grab read/write lock when using node ref obj v4: - clone traffics between netns to loopback Suggested-by: Jon Maloy <jon.maloy@ericsson.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29inet: do not call sublist_rcv on empty listFlorian Westphal2-2/+4
syzbot triggered struct net NULL deref in NF_HOOK_LIST: RIP: 0010:NF_HOOK_LIST include/linux/netfilter.h:331 [inline] RIP: 0010:ip6_sublist_rcv+0x5c9/0x930 net/ipv6/ip6_input.c:292 ipv6_list_rcv+0x373/0x4b0 net/ipv6/ip6_input.c:328 __netif_receive_skb_list_ptype net/core/dev.c:5274 [inline] Reason: void ipv6_list_rcv(struct list_head *head, struct packet_type *pt, struct net_device *orig_dev) [..] list_for_each_entry_safe(skb, next, head, list) { /* iterates list */ skb = ip6_rcv_core(skb, dev, net); /* ip6_rcv_core drops skb -> NULL is returned */ if (skb == NULL) continue; [..] } /* sublist is empty -> curr_net is NULL */ ip6_sublist_rcv(&sublist, curr_dev, curr_net); Before the recent change NF_HOOK_LIST did a list iteration before struct net deref, i.e. it was a no-op in the empty list case. List iteration now happens after *net deref, causing crash. Follow the same pattern as the ip(v6)_list_rcv loop and add a list_empty test for the final sublist dispatch too. Cc: Edward Cree <ecree@solarflare.com> Reported-by: syzbot+c54f457cad330e57e967@syzkaller.appspotmail.com Fixes: ca58fbe06c54 ("netfilter: add and use nf_hook_slow_list()") Signed-off-by: Florian Westphal <fw@strlen.de> Tested-by: Leon Romanovsky <leonro@mellanox.com> Tested-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29broadcom: bnxt: Fix use true/false for boolSaurav Girepunje1-1/+1
Use true/false for bool type in bnxt_timer function. Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Acked-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29cavium: thunder: Fix use true/false for bool typeSaurav Girepunje1-6/+6
use true/false on bool type variables for assignment. Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: phy: marvell: add PHY tunable support for more PHY versionsHeiner Kallweit1-0/+12
More PHY versions are compatible with the existing downshift implementation, so let's add downshift support for them. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: phy: marvell: add downshift support for M88E1111Heiner Kallweit1-0/+64
This patch adds downshift support for M88E1111. This PHY version uses another register for downshift configuration, reading downshift status is possible via the same register as for other PHY versions. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: phy: marvell: fix downshift function namingHeiner Kallweit1-15/+15
I got access to the M88E1111 datasheet, and this PHY version uses another register for downshift configuration. Therefore change prefix to m88e1011, aligned with constants like MII_M1011_PHY_SCR. Fixes: a3bdfce7bf9c ("net: phy: marvell: support downshift as PHY tunable") Reported-by: Chris Healy <Chris.Healy@zii.aero> Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: phy: marvell: fix typo in constant MII_M1011_PHY_SRC_DOWNSHIFT_MASKHeiner Kallweit1-4/+4
Fix typo and use PHY_SCR for PHY-specific Control Register. Fixes: a3bdfce7bf9c ("net: phy: marvell: support downshift as PHY tunable") Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29Documentation: net-sysfs: describe missing statisticsJulian Wiedmann1-0/+16
Sync the ABI description with the interface statistics that are currently available through sysfs. CC: Jarod Wilson <jarod@redhat.com> CC: Jonathan Corbet <corbet@lwn.net> CC: linux-doc@vger.kernel.org Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29ionic: Remove set but not used variable 'sg_desc'YueHaibing1-2/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/ethernet/pensando/ionic/ionic_txrx.c: In function 'ionic_rx_empty': drivers/net/ethernet/pensando/ionic/ionic_txrx.c:405:28: warning: variable 'sg_desc' set but not used [-Wunused-but-set-variable] It is never used, so can be removed. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Shannon Nelson <snelson@pensando.io> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: phy: dp83867: support Wake on LANThomas Haemmerle1-1/+130
This adds WoL support on TI DP83867 for magic, magic secure, unicast and broadcast. Signed-off-by: Thomas Haemmerle <thomas.haemmerle@wolfvision.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: aquantia: fix error handling in aq_ptp_pollGustavo A. R. Silva1-0/+2
Fix currenty ignored returned error by properly checking *err* after calling aq_nic->aq_hw_ops->hw_ring_hwts_rx_fill(). Addresses-Coverity-ID: 1487357 ("Unused value") Fixes: 04a1839950d9 ("net: aquantia: implement data PTP datapath") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: Igor Russkikh <irusskikh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: aquantia: remove unused including <linux/version.h>YueHaibing1-1/+0
Remove including <linux/version.h> that don't need it. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: dsa: LAN9303: select REGMAP when LAN9303 enableMao Wenan1-0/+1
When NET_DSA_SMSC_LAN9303=y and NET_DSA_SMSC_LAN9303_MDIO=y, below errors can be seen: drivers/net/dsa/lan9303_mdio.c:87:23: error: REGMAP_ENDIAN_LITTLE undeclared here (not in a function) .reg_format_endian = REGMAP_ENDIAN_LITTLE, drivers/net/dsa/lan9303_mdio.c:93:3: error: const struct regmap_config has no member named reg_read .reg_read = lan9303_mdio_read, It should select REGMAP in config NET_DSA_SMSC_LAN9303. Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support") Signed-off-by: Mao Wenan <maowenan@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: aquantia: make two symbols be staticMao Wenan2-2/+2
When using ARCH=mips CROSS_COMPILE=mips-linux-gnu- to build drivers/net/ethernet/aquantia/atlantic/aq_ptp.o and drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.o, below errors can be seen: drivers/net/ethernet/aquantia/atlantic/aq_ptp.c:1378:6: warning: symbol 'aq_ptp_poll_sync_work_cb' was not declared. Should it be static? drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c:1155:5: warning: symbol 'hw_atl_b0_ts_to_sys_clock' was not declared. Should it be static? This patch to make aq_ptp_poll_sync_work_cb and hw_atl_b0_ts_to_sys_clock be static to fix these warnings. Fixes: 9c477032f7d0 ("net: aquantia: add support for PIN funcs") Signed-off-by: Mao Wenan <maowenan@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: fec: remove redundant assignment to pointer bdpColin Ian King1-1/+0
The pointer bdp is being assigned with a value that is never read, so the assignment is redundant and hence can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Fugang Duan <fugang.duan@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: dsa: return directly from dsa_to_portVivien Didelot1-3/+3
Return directly from within the loop as soon as the port is found, otherwise we won't return NULL if the end of the list is reached. Fixes: b96ddf254b09 ("net: dsa: use ports list in dsa_to_port") Signed-off-by: Vivien Didelot <vivien.didelot@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: aquantia: fix unintention integer overflow on left shiftColin Ian King1-1/+1
Shifting the integer value 1 is evaluated using 32-bit arithmetic and then used in an expression that expects a 64-bit value, so there is potentially an integer overflow. Fix this by using the BIT_ULL macro to perform the shift and avoid the overflow. Addresses-Coverity: ("Unintentional integer overflow") Fixes: 04a1839950d9 ("net: aquantia: implement data PTP datapath") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Igor Russkikh <irusskikh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-29net: aquantia: fix spelling mistake: tx_queus -> tx_queuesColin Ian King1-1/+1
There is a spelling mistake in a netdev_err error message. Fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Igor Russkikh <irusskikh@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28atm: remove unneeded semicolonYueHaibing1-1/+1
remove unneeded semicolon. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28sock: remove unneeded semicolonYueHaibing1-1/+1
remove unneeded semicolon. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: mediatek: remove unneeded semicolonYueHaibing2-4/+4
remove unneeded semicolon. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28mlxsw: spectrum_buffers: remove unneeded semicolonYueHaibing1-2/+2
Remove excess semicolon after closing parenthesis. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: dsa: mv88e6xxx: Add devlink param for ATU hash algorithm.Andrew Lunn6-1/+177
Some of the marvell switches have bits controlling the hash algorithm the ATU uses for MAC addresses. In some industrial settings, where all the devices are from the same manufacture, and hence use the same OUI, the default hashing algorithm is not optimal. Allow the other algorithms to be selected via devlink. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: dsa: Add support for devlink device parametersAndrew Lunn3-1/+77
Add plumbing to allow DSA drivers to register parameters with devlink. To keep with the abstraction, the DSA drivers pass the ds structure to these helpers, and the DSA core then translates that to the devlink structure associated to the device. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28r8169: use helper rtl_hw_aspm_clkreq_enable also in rtl_hw_start_8168g_2Heiner Kallweit1-2/+1
One place in the driver was left where the open-coded functionality hasn't been replaced with helper rtl_hw_aspm_clkreq_enable yet. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: dsa: bcm_sf2: Wire up MDB operationsFlorian Fainelli1-0/+3
Leverage the recently add b53_mdb_{add,del,prepare} functions since they work as-is for bcm_sf2. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: dsa: b53: Add support for MDBFlorian Fainelli2-3/+67
In preparation for supporting IGMP snooping with or without the use of a bridge, add support within b53_common.c to program the ARL entries for multicast operations. The key difference is that a multicast ARL entry is comprised of a bitmask of enabled ports, instead of a port number. Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28mvpp2: prefetch frame headerMatteo Croce1-0/+1
When receiving traffic, eth_type_trans() is high up on the perf top list, because it's the first function which access the packet data. Move the DMA unmap a bit higher, and put a prefetch just after it, so we have more time to load the data into the cache. The packet rate increase is about 14% with a tc drop test: 1620 => 1853 kpps Signed-off-by: Matteo Croce <mcroce@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28mvpp2: sync only the received frameMatteo Croce1-2/+7
In the RX path we always sync against the maximum frame size for that pool. Do the DMA sync and the unmap separately, so we can only sync by the size of the received frame. Signed-off-by: Matteo Croce <mcroce@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28mvpp2: refactor frame drop routineMatteo Croce1-8/+9
Move some code down to remove a backward goto. Signed-off-by: Matteo Croce <mcroce@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28isdn: hfcsusb: Spelling and grammar fixesGeert Uytterhoeven1-2/+2
Fix misspellings of "endpoints", "configuration", and "device's". Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28tipc: Spelling s/enpoint/endpoint/Geert Uytterhoeven1-1/+1
Fix misspelling of "endpoint". Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: Fix various misspellings of "connect"Geert Uytterhoeven5-6/+6
Fix misspellings of "disconnect", "disconnecting", "connections", and "disconnected". Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Kalle Valo <kvalo@codeaurora.org> Acked-by: Simon Horman <horms@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: Fix misspellings of "configure" and "configuration"Geert Uytterhoeven8-9/+9
Fix various misspellings of "configuration" and "configure". Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: dsa: qca8k: Initialize the switch with correct number of portsMichal Vokáč1-1/+1
Since commit 0394a63acfe2 ("net: dsa: enable and disable all ports") the dsa core disables all unused ports of a switch. In this case disabling ports with numbers higher than QCA8K_NUM_PORTS causes that some switch registers are overwritten with incorrect content. To fix this, initialize the dsa_switch->num_ports with correct number of ports. Fixes: 7e99e3470172 ("net: dsa: remove dsa_switch_alloc helper") Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28net: dsa: fix dereference on ds->dev before null check errorColin Ian King1-2/+5
Currently ds->dev is dereferenced on the assignments of pdata and np before ds->dev is null checked, hence there is a potential null pointer dereference on ds->dev. Fix this by assigning pdata and np after the ds->dev null pointer sanity check. Addresses-Coverity: ("Dereference before null check") Fixes: 7e99e3470172 ("net: dsa: remove dsa_switch_alloc helper") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Reported-by: kbuild test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-26tc-testing: list required kernel options for act_ct actionRoman Mashak1-0/+10
Updated config with required kernel options for conntrac TC action, so that tdc can run the tests. Signed-off-by: Roman Mashak <mrv@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-26net: aquantia: disable ptp object build if no configIgor Russkikh2-1/+86
We do disable aq_ptp module build using inline stubs when CONFIG_PTP_1588_CLOCK is not declared. This reduces module size and removes unnecessary code. Reported-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com> Acked-by: Richard Cochran <richardcochran@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-26net: aquantia: fix warnings on endiannessIgor Russkikh2-6/+5
fixes to remove sparse warnings: sparse: sparse: cast to restricted __be64 Fixes: 04a1839950d9 ("net: aquantia: implement data PTP datapath") Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-26net: aquantia: fix var initialization warningIgor Russkikh1-1/+1
found by sparse, simply useless local initialization with zero. Fixes: 94ad94558b0f ("net: aquantia: add PTP rings infrastructure") Reported-by: kbuild test robot <lkp@intel.com> Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-26netfilter: nf_tables_offload: unbind if multi-device binding failsPablo Neira Ayuso1-2/+17
nft_flow_block_chain() needs to unbind in case of error when performing the multi-device binding. Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices per netdev hook") Reported-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2019-10-26netfilter: nf_tables_offload: add nft_flow_block_offload_init()Pablo Neira Ayuso1-21/+21
This patch adds the nft_flow_block_offload_init() helper function to initialize the flow_block_offload object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2019-10-26netfilter: nf_tables_offload: add nft_chain_offload_cmd()Pablo Neira Ayuso1-5/+15
This patch adds the nft_chain_offload_cmd() helper function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2019-10-26netfilter: ecache: don't look for ecache extension on dying/unconfirmed conntracksFlorian Westphal1-3/+3
syzbot reported following splat: BUG: KASAN: use-after-free in __nf_ct_ext_exist include/net/netfilter/nf_conntrack_extend.h:53 [inline] BUG: KASAN: use-after-free in nf_ct_deliver_cached_events+0x5c3/0x6d0 net/netfilter/nf_conntrack_ecache.c:205 nf_conntrack_confirm include/net/netfilter/nf_conntrack_core.h:65 [inline] nf_confirm+0x3d8/0x4d0 net/netfilter/nf_conntrack_proto.c:154 [..] While there is no reproducer yet, the syzbot report contains one interesting bit of information: Freed by task 27585: [..] kfree+0x10a/0x2c0 mm/slab.c:3757 nf_ct_ext_destroy+0x2ab/0x2e0 net/netfilter/nf_conntrack_extend.c:38 nf_conntrack_free+0x8f/0xe0 net/netfilter/nf_conntrack_core.c:1418 destroy_conntrack+0x1a2/0x270 net/netfilter/nf_conntrack_core.c:626 nf_conntrack_put include/linux/netfilter/nf_conntrack_common.h:31 [inline] nf_ct_resolve_clash net/netfilter/nf_conntrack_core.c:915 [inline] ^^^^^^^^^^^^^^^^^^^ __nf_conntrack_confirm+0x21ca/0x2830 net/netfilter/nf_conntrack_core.c:1038 nf_conntrack_confirm include/net/netfilter/nf_conntrack_core.h:63 [inline] nf_confirm+0x3e7/0x4d0 net/netfilter/nf_conntrack_proto.c:154 This is whats happening: 1. a conntrack entry is about to be confirmed (added to hash table). 2. a clash with existing entry is detected. 3. nf_ct_resolve_clash() puts skb->nfct (the "losing" entry). 4. this entry now has a refcount of 0 and is freed to SLAB_TYPESAFE_BY_RCU kmem cache. skb->nfct has been replaced by the one found in the hash. Problem is that nf_conntrack_confirm() uses the old ct: static inline int nf_conntrack_confirm(struct sk_buff *skb) { struct nf_conn *ct = (struct nf_conn *)skb_nfct(skb); int ret = NF_ACCEPT; if (ct) { if (!nf_ct_is_confirmed(ct)) ret = __nf_conntrack_confirm(skb); if (likely(ret == NF_ACCEPT)) nf_ct_deliver_cached_events(ct); /* This ct has refcount 0! */ } return ret; } As of "netfilter: conntrack: free extension area immediately", we can't access conntrack extensions in this case. To fix this, make sure we check the dying bit presence before attempting to get the eache extension. Reported-by: syzbot+c7aabc9fe93e7f3637ba@syzkaller.appspotmail.com Fixes: 2ad9d7747c10d1 ("netfilter: conntrack: free extension area immediately") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2019-10-25ionic: update driver versionShannon Nelson1-1/+1
Signed-off-by: Shannon Nelson <snelson@pensando.io> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-25ionic: implement support for rx sglShannon Nelson3-84/+224
Even out Rx performance across MTU sizes by changing from full skb allocations to page-based frag allocations. The device supports a form of scatter-gather in the Rx path, so we can set up a number of pages for each descriptor, all of which are easier to alloc and pass around than the standard kzalloc'd buffer. An skb is wrapped around the pages while processing the received packets, and pages are recycled as needed, or left alone if they weren't used in the Rx. Signed-off-by: Shannon Nelson <snelson@pensando.io> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-25ionic: add a watchdog timer to monitor heartbeatShannon Nelson3-2/+20
Add a watchdog to periodically monitor the NIC heartbeat. Signed-off-by: Shannon Nelson <snelson@pensando.io> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-25ionic: add heartbeat checkShannon Nelson3-1/+70
Most of our firmware has a heartbeat feature that the driver can watch for to see if the FW is still alive and likely to answer a dev_cmd or AdminQ request. Signed-off-by: Shannon Nelson <snelson@pensando.io> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-25ionic: reverse an interrupt coalesce calculationShannon Nelson1-1/+1
Fix the initial interrupt coalesce usec-to-hw setting to actually be usec-to-hw. Fixes: 780eded34ccc ("ionic: report users coalesce request") Signed-off-by: Shannon Nelson <snelson@pensando.io> Signed-off-by: David S. Miller <davem@davemloft.net>