Contents of /trunk/kernel-alx-legacy/patches-4.9/0233-4.9.134-all-fixes.patch
Parent Directory | Revision Log
Revision 3608 -
(show annotations)
(download)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 141982 byte(s)
Fri Aug 14 07:34:29 2020 UTC (4 years, 1 month ago) by niro
File size: 141982 byte(s)
-added kerenl-alx-legacy pkg
1 | diff --git a/Documentation/devicetree/bindings/net/macb.txt b/Documentation/devicetree/bindings/net/macb.txt |
2 | index 1506e948610c..d1f435c92912 100644 |
3 | --- a/Documentation/devicetree/bindings/net/macb.txt |
4 | +++ b/Documentation/devicetree/bindings/net/macb.txt |
5 | @@ -10,6 +10,7 @@ Required properties: |
6 | Use "cdns,pc302-gem" for Picochip picoXcell pc302 and later devices based on |
7 | the Cadence GEM, or the generic form: "cdns,gem". |
8 | Use "atmel,sama5d2-gem" for the GEM IP (10/100) available on Atmel sama5d2 SoCs. |
9 | + Use "atmel,sama5d3-macb" for the 10/100Mbit IP available on Atmel sama5d3 SoCs. |
10 | Use "atmel,sama5d3-gem" for the Gigabit IP available on Atmel sama5d3 SoCs. |
11 | Use "atmel,sama5d4-gem" for the GEM IP (10/100) available on Atmel sama5d4 SoCs. |
12 | Use "cdns,zynq-gem" Xilinx Zynq-7xxx SoC. |
13 | diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt |
14 | index 3db8c67d2c8d..dbdc4130e149 100644 |
15 | --- a/Documentation/networking/ip-sysctl.txt |
16 | +++ b/Documentation/networking/ip-sysctl.txt |
17 | @@ -122,14 +122,11 @@ min_adv_mss - INTEGER |
18 | |
19 | IP Fragmentation: |
20 | |
21 | -ipfrag_high_thresh - INTEGER |
22 | - Maximum memory used to reassemble IP fragments. When |
23 | - ipfrag_high_thresh bytes of memory is allocated for this purpose, |
24 | - the fragment handler will toss packets until ipfrag_low_thresh |
25 | - is reached. This also serves as a maximum limit to namespaces |
26 | - different from the initial one. |
27 | - |
28 | -ipfrag_low_thresh - INTEGER |
29 | +ipfrag_high_thresh - LONG INTEGER |
30 | + Maximum memory used to reassemble IP fragments. |
31 | + |
32 | +ipfrag_low_thresh - LONG INTEGER |
33 | + (Obsolete since linux-4.17) |
34 | Maximum memory used to reassemble IP fragments before the kernel |
35 | begins to remove incomplete fragment queues to free up resources. |
36 | The kernel still accepts new fragments for defragmentation. |
37 | diff --git a/Makefile b/Makefile |
38 | index 18090f899a7c..46135e4333e6 100644 |
39 | --- a/Makefile |
40 | +++ b/Makefile |
41 | @@ -1,6 +1,6 @@ |
42 | VERSION = 4 |
43 | PATCHLEVEL = 9 |
44 | -SUBLEVEL = 133 |
45 | +SUBLEVEL = 134 |
46 | EXTRAVERSION = |
47 | NAME = Roaring Lionus |
48 | |
49 | diff --git a/arch/arm/boot/dts/sama5d3_emac.dtsi b/arch/arm/boot/dts/sama5d3_emac.dtsi |
50 | index 7cb235ef0fb6..6e9e1c2f9def 100644 |
51 | --- a/arch/arm/boot/dts/sama5d3_emac.dtsi |
52 | +++ b/arch/arm/boot/dts/sama5d3_emac.dtsi |
53 | @@ -41,7 +41,7 @@ |
54 | }; |
55 | |
56 | macb1: ethernet@f802c000 { |
57 | - compatible = "cdns,at91sam9260-macb", "cdns,macb"; |
58 | + compatible = "atmel,sama5d3-macb", "cdns,at91sam9260-macb", "cdns,macb"; |
59 | reg = <0xf802c000 0x100>; |
60 | interrupts = <35 IRQ_TYPE_LEVEL_HIGH 3>; |
61 | pinctrl-names = "default"; |
62 | diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h |
63 | index 739c0c594022..1bb90fafcdc3 100644 |
64 | --- a/arch/x86/include/uapi/asm/kvm.h |
65 | +++ b/arch/x86/include/uapi/asm/kvm.h |
66 | @@ -356,5 +356,6 @@ struct kvm_sync_regs { |
67 | |
68 | #define KVM_X86_QUIRK_LINT0_REENABLED (1 << 0) |
69 | #define KVM_X86_QUIRK_CD_NW_CLEARED (1 << 1) |
70 | +#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE (1 << 2) |
71 | |
72 | #endif /* _ASM_X86_KVM_H */ |
73 | diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c |
74 | index a8a86be8cf15..69a81a7daa24 100644 |
75 | --- a/arch/x86/kvm/lapic.c |
76 | +++ b/arch/x86/kvm/lapic.c |
77 | @@ -1220,9 +1220,8 @@ EXPORT_SYMBOL_GPL(kvm_lapic_reg_read); |
78 | |
79 | static int apic_mmio_in_range(struct kvm_lapic *apic, gpa_t addr) |
80 | { |
81 | - return kvm_apic_hw_enabled(apic) && |
82 | - addr >= apic->base_address && |
83 | - addr < apic->base_address + LAPIC_MMIO_LENGTH; |
84 | + return addr >= apic->base_address && |
85 | + addr < apic->base_address + LAPIC_MMIO_LENGTH; |
86 | } |
87 | |
88 | static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this, |
89 | @@ -1234,6 +1233,15 @@ static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this, |
90 | if (!apic_mmio_in_range(apic, address)) |
91 | return -EOPNOTSUPP; |
92 | |
93 | + if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) { |
94 | + if (!kvm_check_has_quirk(vcpu->kvm, |
95 | + KVM_X86_QUIRK_LAPIC_MMIO_HOLE)) |
96 | + return -EOPNOTSUPP; |
97 | + |
98 | + memset(data, 0xff, len); |
99 | + return 0; |
100 | + } |
101 | + |
102 | kvm_lapic_reg_read(apic, offset, len, data); |
103 | |
104 | return 0; |
105 | @@ -1646,6 +1654,14 @@ static int apic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this, |
106 | if (!apic_mmio_in_range(apic, address)) |
107 | return -EOPNOTSUPP; |
108 | |
109 | + if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) { |
110 | + if (!kvm_check_has_quirk(vcpu->kvm, |
111 | + KVM_X86_QUIRK_LAPIC_MMIO_HOLE)) |
112 | + return -EOPNOTSUPP; |
113 | + |
114 | + return 0; |
115 | + } |
116 | + |
117 | /* |
118 | * APIC register must be aligned on 128-bits boundary. |
119 | * 32/64/128 bits registers must be accessed thru 32 bits. |
120 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c |
121 | index 47951f4775b9..d47c32a18da8 100644 |
122 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c |
123 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c |
124 | @@ -505,7 +505,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd, |
125 | |
126 | while (true) { |
127 | temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS); |
128 | - if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT) |
129 | + if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK) |
130 | break; |
131 | if (timeout <= 0) |
132 | return -ETIME; |
133 | diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c |
134 | index 7aa7b9cb6203..efefcfa24a4c 100644 |
135 | --- a/drivers/i2c/busses/i2c-scmi.c |
136 | +++ b/drivers/i2c/busses/i2c-scmi.c |
137 | @@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, |
138 | mt_params[3].type = ACPI_TYPE_INTEGER; |
139 | mt_params[3].integer.value = len; |
140 | mt_params[4].type = ACPI_TYPE_BUFFER; |
141 | + mt_params[4].buffer.length = len; |
142 | mt_params[4].buffer.pointer = data->block + 1; |
143 | } |
144 | break; |
145 | diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c |
146 | index 7aab376ecb84..3785c638d530 100644 |
147 | --- a/drivers/mfd/omap-usb-host.c |
148 | +++ b/drivers/mfd/omap-usb-host.c |
149 | @@ -548,8 +548,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev, |
150 | } |
151 | |
152 | static const struct of_device_id usbhs_child_match_table[] = { |
153 | - { .compatible = "ti,omap-ehci", }, |
154 | - { .compatible = "ti,omap-ohci", }, |
155 | + { .compatible = "ti,ehci-omap", }, |
156 | + { .compatible = "ti,ohci-omap3", }, |
157 | { } |
158 | }; |
159 | |
160 | @@ -875,6 +875,7 @@ static struct platform_driver usbhs_omap_driver = { |
161 | .pm = &usbhsomap_dev_pm_ops, |
162 | .of_match_table = usbhs_omap_dt_ids, |
163 | }, |
164 | + .probe = usbhs_omap_probe, |
165 | .remove = usbhs_omap_remove, |
166 | }; |
167 | |
168 | @@ -884,9 +885,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME); |
169 | MODULE_LICENSE("GPL v2"); |
170 | MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI"); |
171 | |
172 | -static int __init omap_usbhs_drvinit(void) |
173 | +static int omap_usbhs_drvinit(void) |
174 | { |
175 | - return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe); |
176 | + return platform_driver_register(&usbhs_omap_driver); |
177 | } |
178 | |
179 | /* |
180 | @@ -898,7 +899,7 @@ static int __init omap_usbhs_drvinit(void) |
181 | */ |
182 | fs_initcall_sync(omap_usbhs_drvinit); |
183 | |
184 | -static void __exit omap_usbhs_drvexit(void) |
185 | +static void omap_usbhs_drvexit(void) |
186 | { |
187 | platform_driver_unregister(&usbhs_omap_driver); |
188 | } |
189 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
190 | index 8a5e0ae4e4c0..b1ea29d8ad1a 100644 |
191 | --- a/drivers/net/bonding/bond_main.c |
192 | +++ b/drivers/net/bonding/bond_main.c |
193 | @@ -216,6 +216,7 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, |
194 | static void bond_slave_arr_handler(struct work_struct *work); |
195 | static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act, |
196 | int mod); |
197 | +static void bond_netdev_notify_work(struct work_struct *work); |
198 | |
199 | /*---------------------------- General routines -----------------------------*/ |
200 | |
201 | @@ -1250,6 +1251,8 @@ static struct slave *bond_alloc_slave(struct bonding *bond) |
202 | return NULL; |
203 | } |
204 | } |
205 | + INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); |
206 | + |
207 | return slave; |
208 | } |
209 | |
210 | @@ -1257,6 +1260,7 @@ static void bond_free_slave(struct slave *slave) |
211 | { |
212 | struct bonding *bond = bond_get_bond_by_slave(slave); |
213 | |
214 | + cancel_delayed_work_sync(&slave->notify_work); |
215 | if (BOND_MODE(bond) == BOND_MODE_8023AD) |
216 | kfree(SLAVE_AD_INFO(slave)); |
217 | |
218 | @@ -1278,39 +1282,26 @@ static void bond_fill_ifslave(struct slave *slave, struct ifslave *info) |
219 | info->link_failure_count = slave->link_failure_count; |
220 | } |
221 | |
222 | -static void bond_netdev_notify(struct net_device *dev, |
223 | - struct netdev_bonding_info *info) |
224 | -{ |
225 | - rtnl_lock(); |
226 | - netdev_bonding_info_change(dev, info); |
227 | - rtnl_unlock(); |
228 | -} |
229 | - |
230 | static void bond_netdev_notify_work(struct work_struct *_work) |
231 | { |
232 | - struct netdev_notify_work *w = |
233 | - container_of(_work, struct netdev_notify_work, work.work); |
234 | + struct slave *slave = container_of(_work, struct slave, |
235 | + notify_work.work); |
236 | + |
237 | + if (rtnl_trylock()) { |
238 | + struct netdev_bonding_info binfo; |
239 | |
240 | - bond_netdev_notify(w->dev, &w->bonding_info); |
241 | - dev_put(w->dev); |
242 | - kfree(w); |
243 | + bond_fill_ifslave(slave, &binfo.slave); |
244 | + bond_fill_ifbond(slave->bond, &binfo.master); |
245 | + netdev_bonding_info_change(slave->dev, &binfo); |
246 | + rtnl_unlock(); |
247 | + } else { |
248 | + queue_delayed_work(slave->bond->wq, &slave->notify_work, 1); |
249 | + } |
250 | } |
251 | |
252 | void bond_queue_slave_event(struct slave *slave) |
253 | { |
254 | - struct bonding *bond = slave->bond; |
255 | - struct netdev_notify_work *nnw = kzalloc(sizeof(*nnw), GFP_ATOMIC); |
256 | - |
257 | - if (!nnw) |
258 | - return; |
259 | - |
260 | - dev_hold(slave->dev); |
261 | - nnw->dev = slave->dev; |
262 | - bond_fill_ifslave(slave, &nnw->bonding_info.slave); |
263 | - bond_fill_ifbond(bond, &nnw->bonding_info.master); |
264 | - INIT_DELAYED_WORK(&nnw->work, bond_netdev_notify_work); |
265 | - |
266 | - queue_delayed_work(slave->bond->wq, &nnw->work, 0); |
267 | + queue_delayed_work(slave->bond->wq, &slave->notify_work, 0); |
268 | } |
269 | |
270 | void bond_lower_state_changed(struct slave *slave) |
271 | diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c |
272 | index 2ce7ae97ac91..c2cd540e9c9e 100644 |
273 | --- a/drivers/net/dsa/bcm_sf2.c |
274 | +++ b/drivers/net/dsa/bcm_sf2.c |
275 | @@ -744,7 +744,6 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds) |
276 | static int bcm_sf2_sw_resume(struct dsa_switch *ds) |
277 | { |
278 | struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds); |
279 | - unsigned int port; |
280 | int ret; |
281 | |
282 | ret = bcm_sf2_sw_rst(priv); |
283 | @@ -756,12 +755,7 @@ static int bcm_sf2_sw_resume(struct dsa_switch *ds) |
284 | if (priv->hw_params.num_gphy == 1) |
285 | bcm_sf2_gphy_enable_set(ds, true); |
286 | |
287 | - for (port = 0; port < DSA_MAX_PORTS; port++) { |
288 | - if ((1 << port) & ds->enabled_port_mask) |
289 | - bcm_sf2_port_setup(ds, port, NULL); |
290 | - else if (dsa_is_cpu_port(ds, port)) |
291 | - bcm_sf2_imp_setup(ds, port); |
292 | - } |
293 | + ds->ops->setup(ds); |
294 | |
295 | return 0; |
296 | } |
297 | @@ -1135,10 +1129,10 @@ static int bcm_sf2_sw_remove(struct platform_device *pdev) |
298 | { |
299 | struct bcm_sf2_priv *priv = platform_get_drvdata(pdev); |
300 | |
301 | - /* Disable all ports and interrupts */ |
302 | priv->wol_ports_mask = 0; |
303 | - bcm_sf2_sw_suspend(priv->dev->ds); |
304 | dsa_unregister_switch(priv->dev->ds); |
305 | + /* Disable all ports and interrupts */ |
306 | + bcm_sf2_sw_suspend(priv->dev->ds); |
307 | bcm_sf2_mdio_unregister(priv); |
308 | |
309 | return 0; |
310 | diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c |
311 | index 91fbba58d033..16dc9ac7ecb6 100644 |
312 | --- a/drivers/net/ethernet/broadcom/bcmsysport.c |
313 | +++ b/drivers/net/ethernet/broadcom/bcmsysport.c |
314 | @@ -828,14 +828,22 @@ static void bcm_sysport_resume_from_wol(struct bcm_sysport_priv *priv) |
315 | { |
316 | u32 reg; |
317 | |
318 | - /* Stop monitoring MPD interrupt */ |
319 | - intrl2_0_mask_set(priv, INTRL2_0_MPD); |
320 | - |
321 | /* Clear the MagicPacket detection logic */ |
322 | reg = umac_readl(priv, UMAC_MPD_CTRL); |
323 | reg &= ~MPD_EN; |
324 | umac_writel(priv, reg, UMAC_MPD_CTRL); |
325 | |
326 | + reg = intrl2_0_readl(priv, INTRL2_CPU_STATUS); |
327 | + if (reg & INTRL2_0_MPD) |
328 | + netdev_info(priv->netdev, "Wake-on-LAN (MPD) interrupt!\n"); |
329 | + |
330 | + if (reg & INTRL2_0_BRCM_MATCH_TAG) { |
331 | + reg = rxchk_readl(priv, RXCHK_BRCM_TAG_MATCH_STATUS) & |
332 | + RXCHK_BRCM_TAG_MATCH_MASK; |
333 | + netdev_info(priv->netdev, |
334 | + "Wake-on-LAN (filters 0x%02x) interrupt!\n", reg); |
335 | + } |
336 | + |
337 | netif_dbg(priv, wol, priv->netdev, "resumed from WOL\n"); |
338 | } |
339 | |
340 | @@ -868,11 +876,6 @@ static irqreturn_t bcm_sysport_rx_isr(int irq, void *dev_id) |
341 | if (priv->irq0_stat & INTRL2_0_TX_RING_FULL) |
342 | bcm_sysport_tx_reclaim_all(priv); |
343 | |
344 | - if (priv->irq0_stat & INTRL2_0_MPD) { |
345 | - netdev_info(priv->netdev, "Wake-on-LAN interrupt!\n"); |
346 | - bcm_sysport_resume_from_wol(priv); |
347 | - } |
348 | - |
349 | return IRQ_HANDLED; |
350 | } |
351 | |
352 | @@ -1901,9 +1904,6 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) |
353 | /* UniMAC receive needs to be turned on */ |
354 | umac_enable_set(priv, CMD_RX_EN, 1); |
355 | |
356 | - /* Enable the interrupt wake-up source */ |
357 | - intrl2_0_mask_clear(priv, INTRL2_0_MPD); |
358 | - |
359 | netif_dbg(priv, wol, ndev, "entered WOL mode\n"); |
360 | |
361 | return 0; |
362 | diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c |
363 | index 72297b76944f..208e9dacfd34 100644 |
364 | --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c |
365 | +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c |
366 | @@ -1666,8 +1666,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) |
367 | if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { |
368 | tx_pkts++; |
369 | /* return full budget so NAPI will complete. */ |
370 | - if (unlikely(tx_pkts > bp->tx_wake_thresh)) |
371 | + if (unlikely(tx_pkts > bp->tx_wake_thresh)) { |
372 | rx_pkts = budget; |
373 | + raw_cons = NEXT_RAW_CMP(raw_cons); |
374 | + break; |
375 | + } |
376 | } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { |
377 | rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &agg_event); |
378 | if (likely(rc >= 0)) |
379 | @@ -1685,7 +1688,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) |
380 | } |
381 | raw_cons = NEXT_RAW_CMP(raw_cons); |
382 | |
383 | - if (rx_pkts == budget) |
384 | + if (rx_pkts && rx_pkts == budget) |
385 | break; |
386 | } |
387 | |
388 | @@ -1797,8 +1800,12 @@ static int bnxt_poll(struct napi_struct *napi, int budget) |
389 | while (1) { |
390 | work_done += bnxt_poll_work(bp, bnapi, budget - work_done); |
391 | |
392 | - if (work_done >= budget) |
393 | + if (work_done >= budget) { |
394 | + if (!budget) |
395 | + BNXT_CP_DB_REARM(cpr->cp_doorbell, |
396 | + cpr->cp_raw_cons); |
397 | break; |
398 | + } |
399 | |
400 | if (!bnxt_has_work(bp, cpr)) { |
401 | napi_complete(napi); |
402 | diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c |
403 | index 2e1585635083..8f55c23e9821 100644 |
404 | --- a/drivers/net/ethernet/cadence/macb.c |
405 | +++ b/drivers/net/ethernet/cadence/macb.c |
406 | @@ -2861,6 +2861,13 @@ static const struct macb_config at91sam9260_config = { |
407 | .init = macb_init, |
408 | }; |
409 | |
410 | +static const struct macb_config sama5d3macb_config = { |
411 | + .caps = MACB_CAPS_SG_DISABLED |
412 | + | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, |
413 | + .clk_init = macb_clk_init, |
414 | + .init = macb_init, |
415 | +}; |
416 | + |
417 | static const struct macb_config pc302gem_config = { |
418 | .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE, |
419 | .dma_burst_length = 16, |
420 | @@ -2925,6 +2932,7 @@ static const struct of_device_id macb_dt_ids[] = { |
421 | { .compatible = "cdns,gem", .data = &pc302gem_config }, |
422 | { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config }, |
423 | { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config }, |
424 | + { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config }, |
425 | { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config }, |
426 | { .compatible = "cdns,at91rm9200-emac", .data = &emac_config }, |
427 | { .compatible = "cdns,emac", .data = &emac_config }, |
428 | diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c |
429 | index b6ed818f78ff..06bc8638501e 100644 |
430 | --- a/drivers/net/ethernet/hisilicon/hns/hnae.c |
431 | +++ b/drivers/net/ethernet/hisilicon/hns/hnae.c |
432 | @@ -80,7 +80,7 @@ static void hnae_unmap_buffer(struct hnae_ring *ring, struct hnae_desc_cb *cb) |
433 | if (cb->type == DESC_TYPE_SKB) |
434 | dma_unmap_single(ring_to_dev(ring), cb->dma, cb->length, |
435 | ring_to_dma_dir(ring)); |
436 | - else |
437 | + else if (cb->length) |
438 | dma_unmap_page(ring_to_dev(ring), cb->dma, cb->length, |
439 | ring_to_dma_dir(ring)); |
440 | } |
441 | diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c |
442 | index 8a2a07e21324..92ed6534ceae 100644 |
443 | --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c |
444 | +++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c |
445 | @@ -39,9 +39,9 @@ |
446 | #define SKB_TMP_LEN(SKB) \ |
447 | (((SKB)->transport_header - (SKB)->mac_header) + tcp_hdrlen(SKB)) |
448 | |
449 | -static void fill_v2_desc(struct hnae_ring *ring, void *priv, |
450 | - int size, dma_addr_t dma, int frag_end, |
451 | - int buf_num, enum hns_desc_type type, int mtu) |
452 | +static void fill_v2_desc_hw(struct hnae_ring *ring, void *priv, int size, |
453 | + int send_sz, dma_addr_t dma, int frag_end, |
454 | + int buf_num, enum hns_desc_type type, int mtu) |
455 | { |
456 | struct hnae_desc *desc = &ring->desc[ring->next_to_use]; |
457 | struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use]; |
458 | @@ -63,7 +63,7 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv, |
459 | desc_cb->type = type; |
460 | |
461 | desc->addr = cpu_to_le64(dma); |
462 | - desc->tx.send_size = cpu_to_le16((u16)size); |
463 | + desc->tx.send_size = cpu_to_le16((u16)send_sz); |
464 | |
465 | /* config bd buffer end */ |
466 | hnae_set_bit(rrcfv, HNSV2_TXD_VLD_B, 1); |
467 | @@ -132,6 +132,14 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv, |
468 | ring_ptr_move_fw(ring, next_to_use); |
469 | } |
470 | |
471 | +static void fill_v2_desc(struct hnae_ring *ring, void *priv, |
472 | + int size, dma_addr_t dma, int frag_end, |
473 | + int buf_num, enum hns_desc_type type, int mtu) |
474 | +{ |
475 | + fill_v2_desc_hw(ring, priv, size, size, dma, frag_end, |
476 | + buf_num, type, mtu); |
477 | +} |
478 | + |
479 | static const struct acpi_device_id hns_enet_acpi_match[] = { |
480 | { "HISI00C1", 0 }, |
481 | { "HISI00C2", 0 }, |
482 | @@ -288,15 +296,15 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv, |
483 | |
484 | /* when the frag size is bigger than hardware, split this frag */ |
485 | for (k = 0; k < frag_buf_num; k++) |
486 | - fill_v2_desc(ring, priv, |
487 | - (k == frag_buf_num - 1) ? |
488 | + fill_v2_desc_hw(ring, priv, k == 0 ? size : 0, |
489 | + (k == frag_buf_num - 1) ? |
490 | sizeoflast : BD_MAX_SEND_SIZE, |
491 | - dma + BD_MAX_SEND_SIZE * k, |
492 | - frag_end && (k == frag_buf_num - 1) ? 1 : 0, |
493 | - buf_num, |
494 | - (type == DESC_TYPE_SKB && !k) ? |
495 | + dma + BD_MAX_SEND_SIZE * k, |
496 | + frag_end && (k == frag_buf_num - 1) ? 1 : 0, |
497 | + buf_num, |
498 | + (type == DESC_TYPE_SKB && !k) ? |
499 | DESC_TYPE_SKB : DESC_TYPE_PAGE, |
500 | - mtu); |
501 | + mtu); |
502 | } |
503 | |
504 | netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, |
505 | diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c |
506 | index 7e2ebfc565ee..ff62dc7485d5 100644 |
507 | --- a/drivers/net/ethernet/marvell/mvpp2.c |
508 | +++ b/drivers/net/ethernet/marvell/mvpp2.c |
509 | @@ -29,6 +29,7 @@ |
510 | #include <linux/clk.h> |
511 | #include <linux/hrtimer.h> |
512 | #include <linux/ktime.h> |
513 | +#include <linux/if_vlan.h> |
514 | #include <uapi/linux/ppp_defs.h> |
515 | #include <net/ip.h> |
516 | #include <net/ipv6.h> |
517 | @@ -4266,7 +4267,7 @@ static void mvpp2_txq_desc_put(struct mvpp2_tx_queue *txq) |
518 | } |
519 | |
520 | /* Set Tx descriptors fields relevant for CSUM calculation */ |
521 | -static u32 mvpp2_txq_desc_csum(int l3_offs, int l3_proto, |
522 | +static u32 mvpp2_txq_desc_csum(int l3_offs, __be16 l3_proto, |
523 | int ip_hdr_len, int l4_proto) |
524 | { |
525 | u32 command; |
526 | @@ -5019,14 +5020,15 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) |
527 | if (skb->ip_summed == CHECKSUM_PARTIAL) { |
528 | int ip_hdr_len = 0; |
529 | u8 l4_proto; |
530 | + __be16 l3_proto = vlan_get_protocol(skb); |
531 | |
532 | - if (skb->protocol == htons(ETH_P_IP)) { |
533 | + if (l3_proto == htons(ETH_P_IP)) { |
534 | struct iphdr *ip4h = ip_hdr(skb); |
535 | |
536 | /* Calculate IPv4 checksum and L4 checksum */ |
537 | ip_hdr_len = ip4h->ihl; |
538 | l4_proto = ip4h->protocol; |
539 | - } else if (skb->protocol == htons(ETH_P_IPV6)) { |
540 | + } else if (l3_proto == htons(ETH_P_IPV6)) { |
541 | struct ipv6hdr *ip6h = ipv6_hdr(skb); |
542 | |
543 | /* Read l4_protocol from one of IPv6 extra headers */ |
544 | @@ -5038,7 +5040,7 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) |
545 | } |
546 | |
547 | return mvpp2_txq_desc_csum(skb_network_offset(skb), |
548 | - skb->protocol, ip_hdr_len, l4_proto); |
549 | + l3_proto, ip_hdr_len, l4_proto); |
550 | } |
551 | |
552 | return MVPP2_TXD_L4_CSUM_NOT | MVPP2_TXD_IP_CSUM_DISABLE; |
553 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h |
554 | index 49bad00a0f8f..5ddadcd0c8db 100644 |
555 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h |
556 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h |
557 | @@ -1800,7 +1800,8 @@ struct qlcnic_hardware_ops { |
558 | int (*config_loopback) (struct qlcnic_adapter *, u8); |
559 | int (*clear_loopback) (struct qlcnic_adapter *, u8); |
560 | int (*config_promisc_mode) (struct qlcnic_adapter *, u32); |
561 | - void (*change_l2_filter) (struct qlcnic_adapter *, u64 *, u16); |
562 | + void (*change_l2_filter)(struct qlcnic_adapter *adapter, u64 *addr, |
563 | + u16 vlan, struct qlcnic_host_tx_ring *tx_ring); |
564 | int (*get_board_info) (struct qlcnic_adapter *); |
565 | void (*set_mac_filter_count) (struct qlcnic_adapter *); |
566 | void (*free_mac_list) (struct qlcnic_adapter *); |
567 | @@ -2042,9 +2043,10 @@ static inline int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, |
568 | } |
569 | |
570 | static inline void qlcnic_change_filter(struct qlcnic_adapter *adapter, |
571 | - u64 *addr, u16 id) |
572 | + u64 *addr, u16 vlan, |
573 | + struct qlcnic_host_tx_ring *tx_ring) |
574 | { |
575 | - adapter->ahw->hw_ops->change_l2_filter(adapter, addr, id); |
576 | + adapter->ahw->hw_ops->change_l2_filter(adapter, addr, vlan, tx_ring); |
577 | } |
578 | |
579 | static inline int qlcnic_get_board_info(struct qlcnic_adapter *adapter) |
580 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c |
581 | index c3c28f0960e5..05d32e86bcf7 100644 |
582 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c |
583 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c |
584 | @@ -2132,7 +2132,8 @@ out: |
585 | } |
586 | |
587 | void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, |
588 | - u16 vlan_id) |
589 | + u16 vlan_id, |
590 | + struct qlcnic_host_tx_ring *tx_ring) |
591 | { |
592 | u8 mac[ETH_ALEN]; |
593 | memcpy(&mac, addr, ETH_ALEN); |
594 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h |
595 | index 331ae2c20f40..c8e012b3f7e7 100644 |
596 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h |
597 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h |
598 | @@ -550,7 +550,8 @@ int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32); |
599 | int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32); |
600 | int qlcnic_83xx_config_hw_lro(struct qlcnic_adapter *, int); |
601 | int qlcnic_83xx_config_rss(struct qlcnic_adapter *, int); |
602 | -void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *, u64 *, u16); |
603 | +void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, |
604 | + u16 vlan, struct qlcnic_host_tx_ring *ring); |
605 | int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info *); |
606 | int qlcnic_83xx_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *); |
607 | void qlcnic_83xx_initialize_nic(struct qlcnic_adapter *, int); |
608 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h |
609 | index 4bb33af8e2b3..56a3bd9e37dc 100644 |
610 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h |
611 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h |
612 | @@ -173,7 +173,8 @@ int qlcnic_82xx_napi_add(struct qlcnic_adapter *adapter, |
613 | struct net_device *netdev); |
614 | void qlcnic_82xx_get_beacon_state(struct qlcnic_adapter *); |
615 | void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, |
616 | - u64 *uaddr, u16 vlan_id); |
617 | + u64 *uaddr, u16 vlan_id, |
618 | + struct qlcnic_host_tx_ring *tx_ring); |
619 | int qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *, |
620 | struct ethtool_coalesce *); |
621 | int qlcnic_82xx_set_rx_coalesce(struct qlcnic_adapter *); |
622 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c |
623 | index fedd7366713c..e36129401b71 100644 |
624 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c |
625 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c |
626 | @@ -268,13 +268,12 @@ static void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, |
627 | } |
628 | |
629 | void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, |
630 | - u16 vlan_id) |
631 | + u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring) |
632 | { |
633 | struct cmd_desc_type0 *hwdesc; |
634 | struct qlcnic_nic_req *req; |
635 | struct qlcnic_mac_req *mac_req; |
636 | struct qlcnic_vlan_req *vlan_req; |
637 | - struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring; |
638 | u32 producer; |
639 | u64 word; |
640 | |
641 | @@ -301,7 +300,8 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, |
642 | |
643 | static void qlcnic_send_filter(struct qlcnic_adapter *adapter, |
644 | struct cmd_desc_type0 *first_desc, |
645 | - struct sk_buff *skb) |
646 | + struct sk_buff *skb, |
647 | + struct qlcnic_host_tx_ring *tx_ring) |
648 | { |
649 | struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data); |
650 | struct ethhdr *phdr = (struct ethhdr *)(skb->data); |
651 | @@ -335,7 +335,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, |
652 | tmp_fil->vlan_id == vlan_id) { |
653 | if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime)) |
654 | qlcnic_change_filter(adapter, &src_addr, |
655 | - vlan_id); |
656 | + vlan_id, tx_ring); |
657 | tmp_fil->ftime = jiffies; |
658 | return; |
659 | } |
660 | @@ -350,7 +350,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, |
661 | if (!fil) |
662 | return; |
663 | |
664 | - qlcnic_change_filter(adapter, &src_addr, vlan_id); |
665 | + qlcnic_change_filter(adapter, &src_addr, vlan_id, tx_ring); |
666 | fil->ftime = jiffies; |
667 | fil->vlan_id = vlan_id; |
668 | memcpy(fil->faddr, &src_addr, ETH_ALEN); |
669 | @@ -766,7 +766,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) |
670 | } |
671 | |
672 | if (adapter->drv_mac_learn) |
673 | - qlcnic_send_filter(adapter, first_desc, skb); |
674 | + qlcnic_send_filter(adapter, first_desc, skb, tx_ring); |
675 | |
676 | tx_ring->tx_stats.tx_bytes += skb->len; |
677 | tx_ring->tx_stats.xmit_called++; |
678 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |
679 | index 890e4b083f4f..2019e163e0e9 100644 |
680 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |
681 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |
682 | @@ -71,7 +71,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins) |
683 | * Description: |
684 | * This function validates the number of Unicast address entries supported |
685 | * by a particular Synopsys 10/100/1000 controller. The Synopsys controller |
686 | - * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter |
687 | + * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter |
688 | * logic. This function validates a valid, supported configuration is |
689 | * selected, and defaults to 1 Unicast address if an unsupported |
690 | * configuration is selected. |
691 | @@ -81,8 +81,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries) |
692 | int x = ucast_entries; |
693 | |
694 | switch (x) { |
695 | - case 1: |
696 | - case 32: |
697 | + case 1 ... 32: |
698 | case 64: |
699 | case 128: |
700 | break; |
701 | diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
702 | index f9ec00981b1e..9670aa23ffb9 100644 |
703 | --- a/drivers/net/team/team.c |
704 | +++ b/drivers/net/team/team.c |
705 | @@ -1171,6 +1171,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev) |
706 | return -EBUSY; |
707 | } |
708 | |
709 | + if (dev == port_dev) { |
710 | + netdev_err(dev, "Cannot enslave team device to itself\n"); |
711 | + return -EINVAL; |
712 | + } |
713 | + |
714 | if (port_dev->features & NETIF_F_VLAN_CHALLENGED && |
715 | vlan_uses_dev(dev)) { |
716 | netdev_err(dev, "Device %s is VLAN challenged and team device has VLAN set up\n", |
717 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c |
718 | index 0d4440f28f6b..2b728cc52e3a 100644 |
719 | --- a/drivers/net/usb/qmi_wwan.c |
720 | +++ b/drivers/net/usb/qmi_wwan.c |
721 | @@ -934,6 +934,7 @@ static const struct usb_device_id products[] = { |
722 | {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ |
723 | {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ |
724 | {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ |
725 | + {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */ |
726 | {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */ |
727 | {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)}, /* Cinterion PHxx,PXxx (2 RmNet) */ |
728 | {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)}, /* Cinterion PHxx,PXxx (1 RmNet + USB Audio)*/ |
729 | diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c |
730 | index 03d04011d653..8d3f938c6a51 100644 |
731 | --- a/drivers/net/usb/smsc75xx.c |
732 | +++ b/drivers/net/usb/smsc75xx.c |
733 | @@ -1518,6 +1518,7 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) |
734 | { |
735 | struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); |
736 | if (pdata) { |
737 | + cancel_work_sync(&pdata->set_multicast); |
738 | netif_dbg(dev, ifdown, dev->net, "free pdata\n"); |
739 | kfree(pdata); |
740 | pdata = NULL; |
741 | diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h |
742 | index 0824a8164a24..07ea4fcf4f88 100644 |
743 | --- a/drivers/scsi/qla2xxx/qla_target.h |
744 | +++ b/drivers/scsi/qla2xxx/qla_target.h |
745 | @@ -440,8 +440,8 @@ struct atio_from_isp { |
746 | static inline int fcpcmd_is_corrupted(struct atio *atio) |
747 | { |
748 | if (atio->entry_type == ATIO_TYPE7 && |
749 | - (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) < |
750 | - FCP_CMD_LENGTH_MIN)) |
751 | + ((le16_to_cpu(atio->attr_n_length) & FCP_CMD_LENGTH_MASK) < |
752 | + FCP_CMD_LENGTH_MIN)) |
753 | return 1; |
754 | else |
755 | return 0; |
756 | diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c |
757 | index 04d2b6e25503..80205f3362d4 100644 |
758 | --- a/drivers/target/iscsi/iscsi_target.c |
759 | +++ b/drivers/target/iscsi/iscsi_target.c |
760 | @@ -1435,7 +1435,8 @@ static void iscsit_do_crypto_hash_buf( |
761 | |
762 | sg_init_table(sg, ARRAY_SIZE(sg)); |
763 | sg_set_buf(sg, buf, payload_length); |
764 | - sg_set_buf(sg + 1, pad_bytes, padding); |
765 | + if (padding) |
766 | + sg_set_buf(sg + 1, pad_bytes, padding); |
767 | |
768 | ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding); |
769 | |
770 | @@ -3949,10 +3950,14 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn) |
771 | static void iscsit_get_rx_pdu(struct iscsi_conn *conn) |
772 | { |
773 | int ret; |
774 | - u8 buffer[ISCSI_HDR_LEN], opcode; |
775 | + u8 *buffer, opcode; |
776 | u32 checksum = 0, digest = 0; |
777 | struct kvec iov; |
778 | |
779 | + buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL); |
780 | + if (!buffer) |
781 | + return; |
782 | + |
783 | while (!kthread_should_stop()) { |
784 | /* |
785 | * Ensure that both TX and RX per connection kthreads |
786 | @@ -3960,7 +3965,6 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) |
787 | */ |
788 | iscsit_thread_check_cpumask(conn, current, 0); |
789 | |
790 | - memset(buffer, 0, ISCSI_HDR_LEN); |
791 | memset(&iov, 0, sizeof(struct kvec)); |
792 | |
793 | iov.iov_base = buffer; |
794 | @@ -3969,7 +3973,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) |
795 | ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN); |
796 | if (ret != ISCSI_HDR_LEN) { |
797 | iscsit_rx_thread_wait_for_tcp(conn); |
798 | - return; |
799 | + break; |
800 | } |
801 | |
802 | if (conn->conn_ops->HeaderDigest) { |
803 | @@ -3979,7 +3983,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) |
804 | ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN); |
805 | if (ret != ISCSI_CRC_LEN) { |
806 | iscsit_rx_thread_wait_for_tcp(conn); |
807 | - return; |
808 | + break; |
809 | } |
810 | |
811 | iscsit_do_crypto_hash_buf(conn->conn_rx_hash, |
812 | @@ -4003,7 +4007,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) |
813 | } |
814 | |
815 | if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) |
816 | - return; |
817 | + break; |
818 | |
819 | opcode = buffer[0] & ISCSI_OPCODE_MASK; |
820 | |
821 | @@ -4014,13 +4018,15 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) |
822 | " while in Discovery Session, rejecting.\n", opcode); |
823 | iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR, |
824 | buffer); |
825 | - return; |
826 | + break; |
827 | } |
828 | |
829 | ret = iscsi_target_rx_opcode(conn, buffer); |
830 | if (ret < 0) |
831 | - return; |
832 | + break; |
833 | } |
834 | + |
835 | + kfree(buffer); |
836 | } |
837 | |
838 | int iscsi_target_rx_thread(void *arg) |
839 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c |
840 | index 0722f75f1d6a..45a03eff4db1 100644 |
841 | --- a/drivers/usb/host/xhci-hub.c |
842 | +++ b/drivers/usb/host/xhci-hub.c |
843 | @@ -1072,17 +1072,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, |
844 | temp = readl(port_array[wIndex]); |
845 | break; |
846 | } |
847 | - |
848 | - /* Software should not attempt to set |
849 | - * port link state above '3' (U3) and the port |
850 | - * must be enabled. |
851 | - */ |
852 | - if ((temp & PORT_PE) == 0 || |
853 | - (link_state > USB_SS_PORT_LS_U3)) { |
854 | - xhci_warn(xhci, "Cannot set link state.\n"); |
855 | + /* Port must be enabled */ |
856 | + if (!(temp & PORT_PE)) { |
857 | + retval = -ENODEV; |
858 | + break; |
859 | + } |
860 | + /* Can't set port link state above '3' (U3) */ |
861 | + if (link_state > USB_SS_PORT_LS_U3) { |
862 | + xhci_warn(xhci, "Cannot set port %d link state %d\n", |
863 | + wIndex, link_state); |
864 | goto error; |
865 | } |
866 | - |
867 | if (link_state == USB_SS_PORT_LS_U3) { |
868 | slot_id = xhci_find_slot_id_by_port(hcd, xhci, |
869 | wIndex + 1); |
870 | diff --git a/drivers/video/fbdev/aty/atyfb.h b/drivers/video/fbdev/aty/atyfb.h |
871 | index 63c4842eb224..46e0e8b39b76 100644 |
872 | --- a/drivers/video/fbdev/aty/atyfb.h |
873 | +++ b/drivers/video/fbdev/aty/atyfb.h |
874 | @@ -332,6 +332,8 @@ extern const struct aty_pll_ops aty_pll_ct; /* Integrated */ |
875 | extern void aty_set_pll_ct(const struct fb_info *info, const union aty_pll *pll); |
876 | extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); |
877 | |
878 | +extern const u8 aty_postdividers[8]; |
879 | + |
880 | |
881 | /* |
882 | * Hardware cursor support |
883 | @@ -358,7 +360,6 @@ static inline void wait_for_idle(struct atyfb_par *par) |
884 | |
885 | extern void aty_reset_engine(const struct atyfb_par *par); |
886 | extern void aty_init_engine(struct atyfb_par *par, struct fb_info *info); |
887 | -extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); |
888 | |
889 | void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area); |
890 | void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect); |
891 | diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c |
892 | index 81367cf0af77..da748c39196c 100644 |
893 | --- a/drivers/video/fbdev/aty/atyfb_base.c |
894 | +++ b/drivers/video/fbdev/aty/atyfb_base.c |
895 | @@ -3093,17 +3093,18 @@ static int atyfb_setup_sparc(struct pci_dev *pdev, struct fb_info *info, |
896 | /* |
897 | * PLL Reference Divider M: |
898 | */ |
899 | - M = pll_regs[2]; |
900 | + M = pll_regs[PLL_REF_DIV]; |
901 | |
902 | /* |
903 | * PLL Feedback Divider N (Dependent on CLOCK_CNTL): |
904 | */ |
905 | - N = pll_regs[7 + (clock_cntl & 3)]; |
906 | + N = pll_regs[VCLK0_FB_DIV + (clock_cntl & 3)]; |
907 | |
908 | /* |
909 | * PLL Post Divider P (Dependent on CLOCK_CNTL): |
910 | */ |
911 | - P = 1 << (pll_regs[6] >> ((clock_cntl & 3) << 1)); |
912 | + P = aty_postdividers[((pll_regs[VCLK_POST_DIV] >> ((clock_cntl & 3) << 1)) & 3) | |
913 | + ((pll_regs[PLL_EXT_CNTL] >> (2 + (clock_cntl & 3))) & 4)]; |
914 | |
915 | /* |
916 | * PLL Divider Q: |
917 | diff --git a/drivers/video/fbdev/aty/mach64_ct.c b/drivers/video/fbdev/aty/mach64_ct.c |
918 | index 51f29d627ceb..af54256a20a1 100644 |
919 | --- a/drivers/video/fbdev/aty/mach64_ct.c |
920 | +++ b/drivers/video/fbdev/aty/mach64_ct.c |
921 | @@ -114,7 +114,7 @@ static void aty_st_pll_ct(int offset, u8 val, const struct atyfb_par *par) |
922 | */ |
923 | |
924 | #define Maximum_DSP_PRECISION 7 |
925 | -static u8 postdividers[] = {1,2,4,8,3}; |
926 | +const u8 aty_postdividers[8] = {1,2,4,8,3,5,6,12}; |
927 | |
928 | static int aty_dsp_gt(const struct fb_info *info, u32 bpp, struct pll_ct *pll) |
929 | { |
930 | @@ -221,7 +221,7 @@ static int aty_valid_pll_ct(const struct fb_info *info, u32 vclk_per, struct pll |
931 | pll->vclk_post_div += (q < 64*8); |
932 | pll->vclk_post_div += (q < 32*8); |
933 | } |
934 | - pll->vclk_post_div_real = postdividers[pll->vclk_post_div]; |
935 | + pll->vclk_post_div_real = aty_postdividers[pll->vclk_post_div]; |
936 | // pll->vclk_post_div <<= 6; |
937 | pll->vclk_fb_div = q * pll->vclk_post_div_real / 8; |
938 | pllvclk = (1000000 * 2 * pll->vclk_fb_div) / |
939 | @@ -512,7 +512,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) |
940 | u8 mclk_fb_div, pll_ext_cntl; |
941 | pll->ct.pll_ref_div = aty_ld_pll_ct(PLL_REF_DIV, par); |
942 | pll_ext_cntl = aty_ld_pll_ct(PLL_EXT_CNTL, par); |
943 | - pll->ct.xclk_post_div_real = postdividers[pll_ext_cntl & 0x07]; |
944 | + pll->ct.xclk_post_div_real = aty_postdividers[pll_ext_cntl & 0x07]; |
945 | mclk_fb_div = aty_ld_pll_ct(MCLK_FB_DIV, par); |
946 | if (pll_ext_cntl & PLL_MFB_TIMES_4_2B) |
947 | mclk_fb_div <<= 1; |
948 | @@ -534,7 +534,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) |
949 | xpost_div += (q < 64*8); |
950 | xpost_div += (q < 32*8); |
951 | } |
952 | - pll->ct.xclk_post_div_real = postdividers[xpost_div]; |
953 | + pll->ct.xclk_post_div_real = aty_postdividers[xpost_div]; |
954 | pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8; |
955 | |
956 | #ifdef CONFIG_PPC |
957 | @@ -583,7 +583,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) |
958 | mpost_div += (q < 64*8); |
959 | mpost_div += (q < 32*8); |
960 | } |
961 | - sclk_post_div_real = postdividers[mpost_div]; |
962 | + sclk_post_div_real = aty_postdividers[mpost_div]; |
963 | pll->ct.sclk_fb_div = q * sclk_post_div_real / 8; |
964 | pll->ct.spll_cntl2 = mpost_div << 4; |
965 | #ifdef DEBUG |
966 | diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c |
967 | index c10180d0b018..7d6da09e637b 100644 |
968 | --- a/fs/ext4/xattr.c |
969 | +++ b/fs/ext4/xattr.c |
970 | @@ -657,7 +657,7 @@ ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s, |
971 | next = EXT4_XATTR_NEXT(last); |
972 | if ((void *)next >= s->end) { |
973 | EXT4_ERROR_INODE(inode, "corrupted xattr entries"); |
974 | - return -EIO; |
975 | + return -EFSCORRUPTED; |
976 | } |
977 | if (last->e_value_size) { |
978 | size_t offs = le16_to_cpu(last->e_value_offs); |
979 | diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h |
980 | index 47c7f5b8f675..f254982e1a8f 100644 |
981 | --- a/include/linux/netdevice.h |
982 | +++ b/include/linux/netdevice.h |
983 | @@ -2338,6 +2338,13 @@ struct netdev_notifier_info { |
984 | struct net_device *dev; |
985 | }; |
986 | |
987 | +struct netdev_notifier_info_ext { |
988 | + struct netdev_notifier_info info; /* must be first */ |
989 | + union { |
990 | + u32 mtu; |
991 | + } ext; |
992 | +}; |
993 | + |
994 | struct netdev_notifier_change_info { |
995 | struct netdev_notifier_info info; /* must be first */ |
996 | unsigned int flags_changed; |
997 | diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h |
998 | index 85d1ffc90285..4421e5ccb092 100644 |
999 | --- a/include/linux/rhashtable.h |
1000 | +++ b/include/linux/rhashtable.h |
1001 | @@ -138,7 +138,6 @@ struct rhashtable_params { |
1002 | /** |
1003 | * struct rhashtable - Hash table handle |
1004 | * @tbl: Bucket table |
1005 | - * @nelems: Number of elements in table |
1006 | * @key_len: Key length for hashfn |
1007 | * @elasticity: Maximum chain length before rehash |
1008 | * @p: Configuration parameters |
1009 | @@ -146,10 +145,10 @@ struct rhashtable_params { |
1010 | * @run_work: Deferred worker to expand/shrink asynchronously |
1011 | * @mutex: Mutex to protect current/future table swapping |
1012 | * @lock: Spin lock to protect walker list |
1013 | + * @nelems: Number of elements in table |
1014 | */ |
1015 | struct rhashtable { |
1016 | struct bucket_table __rcu *tbl; |
1017 | - atomic_t nelems; |
1018 | unsigned int key_len; |
1019 | unsigned int elasticity; |
1020 | struct rhashtable_params p; |
1021 | @@ -157,6 +156,7 @@ struct rhashtable { |
1022 | struct work_struct run_work; |
1023 | struct mutex mutex; |
1024 | spinlock_t lock; |
1025 | + atomic_t nelems; |
1026 | }; |
1027 | |
1028 | /** |
1029 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h |
1030 | index 1f207dd22757..e90fe6b83e00 100644 |
1031 | --- a/include/linux/skbuff.h |
1032 | +++ b/include/linux/skbuff.h |
1033 | @@ -643,9 +643,14 @@ struct sk_buff { |
1034 | struct skb_mstamp skb_mstamp; |
1035 | }; |
1036 | }; |
1037 | - struct rb_node rbnode; /* used in netem & tcp stack */ |
1038 | + struct rb_node rbnode; /* used in netem, ip4 defrag, and tcp stack */ |
1039 | }; |
1040 | - struct sock *sk; |
1041 | + |
1042 | + union { |
1043 | + struct sock *sk; |
1044 | + int ip_defrag_offset; |
1045 | + }; |
1046 | + |
1047 | struct net_device *dev; |
1048 | |
1049 | /* |
1050 | @@ -2413,7 +2418,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list) |
1051 | kfree_skb(skb); |
1052 | } |
1053 | |
1054 | -void skb_rbtree_purge(struct rb_root *root); |
1055 | +unsigned int skb_rbtree_purge(struct rb_root *root); |
1056 | |
1057 | void *netdev_alloc_frag(unsigned int fragsz); |
1058 | |
1059 | @@ -2949,6 +2954,7 @@ static inline unsigned char *skb_push_rcsum(struct sk_buff *skb, |
1060 | return skb->data; |
1061 | } |
1062 | |
1063 | +int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len); |
1064 | /** |
1065 | * pskb_trim_rcsum - trim received skb and update checksum |
1066 | * @skb: buffer to trim |
1067 | @@ -2962,9 +2968,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) |
1068 | { |
1069 | if (likely(len >= skb->len)) |
1070 | return 0; |
1071 | - if (skb->ip_summed == CHECKSUM_COMPLETE) |
1072 | - skb->ip_summed = CHECKSUM_NONE; |
1073 | - return __pskb_trim(skb, len); |
1074 | + return pskb_trim_rcsum_slow(skb, len); |
1075 | } |
1076 | |
1077 | static inline int __skb_trim_rcsum(struct sk_buff *skb, unsigned int len) |
1078 | @@ -2984,6 +2988,12 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) |
1079 | |
1080 | #define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) |
1081 | |
1082 | +#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) |
1083 | +#define skb_rb_first(root) rb_to_skb(rb_first(root)) |
1084 | +#define skb_rb_last(root) rb_to_skb(rb_last(root)) |
1085 | +#define skb_rb_next(skb) rb_to_skb(rb_next(&(skb)->rbnode)) |
1086 | +#define skb_rb_prev(skb) rb_to_skb(rb_prev(&(skb)->rbnode)) |
1087 | + |
1088 | #define skb_queue_walk(queue, skb) \ |
1089 | for (skb = (queue)->next; \ |
1090 | skb != (struct sk_buff *)(queue); \ |
1091 | @@ -2998,6 +3008,18 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) |
1092 | for (; skb != (struct sk_buff *)(queue); \ |
1093 | skb = skb->next) |
1094 | |
1095 | +#define skb_rbtree_walk(skb, root) \ |
1096 | + for (skb = skb_rb_first(root); skb != NULL; \ |
1097 | + skb = skb_rb_next(skb)) |
1098 | + |
1099 | +#define skb_rbtree_walk_from(skb) \ |
1100 | + for (; skb != NULL; \ |
1101 | + skb = skb_rb_next(skb)) |
1102 | + |
1103 | +#define skb_rbtree_walk_from_safe(skb, tmp) \ |
1104 | + for (; tmp = skb ? skb_rb_next(skb) : NULL, (skb != NULL); \ |
1105 | + skb = tmp) |
1106 | + |
1107 | #define skb_queue_walk_from_safe(queue, skb, tmp) \ |
1108 | for (tmp = skb->next; \ |
1109 | skb != (struct sk_buff *)(queue); \ |
1110 | diff --git a/include/net/bonding.h b/include/net/bonding.h |
1111 | index 714428c54c68..8750c2c4871a 100644 |
1112 | --- a/include/net/bonding.h |
1113 | +++ b/include/net/bonding.h |
1114 | @@ -139,12 +139,6 @@ struct bond_parm_tbl { |
1115 | int mode; |
1116 | }; |
1117 | |
1118 | -struct netdev_notify_work { |
1119 | - struct delayed_work work; |
1120 | - struct net_device *dev; |
1121 | - struct netdev_bonding_info bonding_info; |
1122 | -}; |
1123 | - |
1124 | struct slave { |
1125 | struct net_device *dev; /* first - useful for panic debug */ |
1126 | struct bonding *bond; /* our master */ |
1127 | @@ -171,6 +165,7 @@ struct slave { |
1128 | #ifdef CONFIG_NET_POLL_CONTROLLER |
1129 | struct netpoll *np; |
1130 | #endif |
1131 | + struct delayed_work notify_work; |
1132 | struct kobject kobj; |
1133 | struct rtnl_link_stats64 slave_stats; |
1134 | }; |
1135 | diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h |
1136 | index 634d19203e7d..a3812e9c8fee 100644 |
1137 | --- a/include/net/inet_frag.h |
1138 | +++ b/include/net/inet_frag.h |
1139 | @@ -1,14 +1,20 @@ |
1140 | #ifndef __NET_FRAG_H__ |
1141 | #define __NET_FRAG_H__ |
1142 | |
1143 | +#include <linux/rhashtable.h> |
1144 | + |
1145 | struct netns_frags { |
1146 | - /* Keep atomic mem on separate cachelines in structs that include it */ |
1147 | - atomic_t mem ____cacheline_aligned_in_smp; |
1148 | /* sysctls */ |
1149 | + long high_thresh; |
1150 | + long low_thresh; |
1151 | int timeout; |
1152 | - int high_thresh; |
1153 | - int low_thresh; |
1154 | int max_dist; |
1155 | + struct inet_frags *f; |
1156 | + |
1157 | + struct rhashtable rhashtable ____cacheline_aligned_in_smp; |
1158 | + |
1159 | + /* Keep atomic mem on separate cachelines in structs that include it */ |
1160 | + atomic_long_t mem ____cacheline_aligned_in_smp; |
1161 | }; |
1162 | |
1163 | /** |
1164 | @@ -24,130 +30,115 @@ enum { |
1165 | INET_FRAG_COMPLETE = BIT(2), |
1166 | }; |
1167 | |
1168 | +struct frag_v4_compare_key { |
1169 | + __be32 saddr; |
1170 | + __be32 daddr; |
1171 | + u32 user; |
1172 | + u32 vif; |
1173 | + __be16 id; |
1174 | + u16 protocol; |
1175 | +}; |
1176 | + |
1177 | +struct frag_v6_compare_key { |
1178 | + struct in6_addr saddr; |
1179 | + struct in6_addr daddr; |
1180 | + u32 user; |
1181 | + __be32 id; |
1182 | + u32 iif; |
1183 | +}; |
1184 | + |
1185 | /** |
1186 | * struct inet_frag_queue - fragment queue |
1187 | * |
1188 | - * @lock: spinlock protecting the queue |
1189 | + * @node: rhash node |
1190 | + * @key: keys identifying this frag. |
1191 | * @timer: queue expiration timer |
1192 | - * @list: hash bucket list |
1193 | + * @lock: spinlock protecting this frag |
1194 | * @refcnt: reference count of the queue |
1195 | * @fragments: received fragments head |
1196 | + * @rb_fragments: received fragments rb-tree root |
1197 | * @fragments_tail: received fragments tail |
1198 | + * @last_run_head: the head of the last "run". see ip_fragment.c |
1199 | * @stamp: timestamp of the last received fragment |
1200 | * @len: total length of the original datagram |
1201 | * @meat: length of received fragments so far |
1202 | * @flags: fragment queue flags |
1203 | * @max_size: maximum received fragment size |
1204 | * @net: namespace that this frag belongs to |
1205 | - * @list_evictor: list of queues to forcefully evict (e.g. due to low memory) |
1206 | + * @rcu: rcu head for freeing deferall |
1207 | */ |
1208 | struct inet_frag_queue { |
1209 | - spinlock_t lock; |
1210 | + struct rhash_head node; |
1211 | + union { |
1212 | + struct frag_v4_compare_key v4; |
1213 | + struct frag_v6_compare_key v6; |
1214 | + } key; |
1215 | struct timer_list timer; |
1216 | - struct hlist_node list; |
1217 | + spinlock_t lock; |
1218 | atomic_t refcnt; |
1219 | - struct sk_buff *fragments; |
1220 | + struct sk_buff *fragments; /* Used in IPv6. */ |
1221 | + struct rb_root rb_fragments; /* Used in IPv4. */ |
1222 | struct sk_buff *fragments_tail; |
1223 | + struct sk_buff *last_run_head; |
1224 | ktime_t stamp; |
1225 | int len; |
1226 | int meat; |
1227 | __u8 flags; |
1228 | u16 max_size; |
1229 | - struct netns_frags *net; |
1230 | - struct hlist_node list_evictor; |
1231 | -}; |
1232 | - |
1233 | -#define INETFRAGS_HASHSZ 1024 |
1234 | - |
1235 | -/* averaged: |
1236 | - * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ / |
1237 | - * rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or |
1238 | - * struct frag_queue)) |
1239 | - */ |
1240 | -#define INETFRAGS_MAXDEPTH 128 |
1241 | - |
1242 | -struct inet_frag_bucket { |
1243 | - struct hlist_head chain; |
1244 | - spinlock_t chain_lock; |
1245 | + struct netns_frags *net; |
1246 | + struct rcu_head rcu; |
1247 | }; |
1248 | |
1249 | struct inet_frags { |
1250 | - struct inet_frag_bucket hash[INETFRAGS_HASHSZ]; |
1251 | - |
1252 | - struct work_struct frags_work; |
1253 | - unsigned int next_bucket; |
1254 | - unsigned long last_rebuild_jiffies; |
1255 | - bool rebuild; |
1256 | - |
1257 | - /* The first call to hashfn is responsible to initialize |
1258 | - * rnd. This is best done with net_get_random_once. |
1259 | - * |
1260 | - * rnd_seqlock is used to let hash insertion detect |
1261 | - * when it needs to re-lookup the hash chain to use. |
1262 | - */ |
1263 | - u32 rnd; |
1264 | - seqlock_t rnd_seqlock; |
1265 | int qsize; |
1266 | |
1267 | - unsigned int (*hashfn)(const struct inet_frag_queue *); |
1268 | - bool (*match)(const struct inet_frag_queue *q, |
1269 | - const void *arg); |
1270 | void (*constructor)(struct inet_frag_queue *q, |
1271 | const void *arg); |
1272 | void (*destructor)(struct inet_frag_queue *); |
1273 | void (*frag_expire)(unsigned long data); |
1274 | struct kmem_cache *frags_cachep; |
1275 | const char *frags_cache_name; |
1276 | + struct rhashtable_params rhash_params; |
1277 | }; |
1278 | |
1279 | int inet_frags_init(struct inet_frags *); |
1280 | void inet_frags_fini(struct inet_frags *); |
1281 | |
1282 | -static inline void inet_frags_init_net(struct netns_frags *nf) |
1283 | +static inline int inet_frags_init_net(struct netns_frags *nf) |
1284 | { |
1285 | - atomic_set(&nf->mem, 0); |
1286 | + atomic_long_set(&nf->mem, 0); |
1287 | + return rhashtable_init(&nf->rhashtable, &nf->f->rhash_params); |
1288 | } |
1289 | -void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); |
1290 | +void inet_frags_exit_net(struct netns_frags *nf); |
1291 | |
1292 | -void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); |
1293 | -void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f); |
1294 | -struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, |
1295 | - struct inet_frags *f, void *key, unsigned int hash); |
1296 | +void inet_frag_kill(struct inet_frag_queue *q); |
1297 | +void inet_frag_destroy(struct inet_frag_queue *q); |
1298 | +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key); |
1299 | |
1300 | -void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, |
1301 | - const char *prefix); |
1302 | +/* Free all skbs in the queue; return the sum of their truesizes. */ |
1303 | +unsigned int inet_frag_rbtree_purge(struct rb_root *root); |
1304 | |
1305 | -static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f) |
1306 | +static inline void inet_frag_put(struct inet_frag_queue *q) |
1307 | { |
1308 | if (atomic_dec_and_test(&q->refcnt)) |
1309 | - inet_frag_destroy(q, f); |
1310 | -} |
1311 | - |
1312 | -static inline bool inet_frag_evicting(struct inet_frag_queue *q) |
1313 | -{ |
1314 | - return !hlist_unhashed(&q->list_evictor); |
1315 | + inet_frag_destroy(q); |
1316 | } |
1317 | |
1318 | /* Memory Tracking Functions. */ |
1319 | |
1320 | -static inline int frag_mem_limit(struct netns_frags *nf) |
1321 | -{ |
1322 | - return atomic_read(&nf->mem); |
1323 | -} |
1324 | - |
1325 | -static inline void sub_frag_mem_limit(struct netns_frags *nf, int i) |
1326 | +static inline long frag_mem_limit(const struct netns_frags *nf) |
1327 | { |
1328 | - atomic_sub(i, &nf->mem); |
1329 | + return atomic_long_read(&nf->mem); |
1330 | } |
1331 | |
1332 | -static inline void add_frag_mem_limit(struct netns_frags *nf, int i) |
1333 | +static inline void sub_frag_mem_limit(struct netns_frags *nf, long val) |
1334 | { |
1335 | - atomic_add(i, &nf->mem); |
1336 | + atomic_long_sub(val, &nf->mem); |
1337 | } |
1338 | |
1339 | -static inline int sum_frag_mem_limit(struct netns_frags *nf) |
1340 | +static inline void add_frag_mem_limit(struct netns_frags *nf, long val) |
1341 | { |
1342 | - return atomic_read(&nf->mem); |
1343 | + atomic_long_add(val, &nf->mem); |
1344 | } |
1345 | |
1346 | /* RFC 3168 support : |
1347 | diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h |
1348 | index 0464b207d0cf..6213a90a8cec 100644 |
1349 | --- a/include/net/inet_sock.h |
1350 | +++ b/include/net/inet_sock.h |
1351 | @@ -132,12 +132,6 @@ static inline int inet_request_bound_dev_if(const struct sock *sk, |
1352 | return sk->sk_bound_dev_if; |
1353 | } |
1354 | |
1355 | -static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq) |
1356 | -{ |
1357 | - return rcu_dereference_check(ireq->ireq_opt, |
1358 | - atomic_read(&ireq->req.rsk_refcnt) > 0); |
1359 | -} |
1360 | - |
1361 | struct inet_cork { |
1362 | unsigned int flags; |
1363 | __be32 addr; |
1364 | diff --git a/include/net/ip.h b/include/net/ip.h |
1365 | index bc9b4deeb60e..8646da034851 100644 |
1366 | --- a/include/net/ip.h |
1367 | +++ b/include/net/ip.h |
1368 | @@ -548,7 +548,6 @@ static inline struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *s |
1369 | return skb; |
1370 | } |
1371 | #endif |
1372 | -int ip_frag_mem(struct net *net); |
1373 | |
1374 | /* |
1375 | * Functions provided by ip_forward.c |
1376 | diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h |
1377 | index 978387d6c3e6..a6446d72c5d9 100644 |
1378 | --- a/include/net/ip_fib.h |
1379 | +++ b/include/net/ip_fib.h |
1380 | @@ -363,6 +363,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev); |
1381 | int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force); |
1382 | int fib_sync_down_addr(struct net_device *dev, __be32 local); |
1383 | int fib_sync_up(struct net_device *dev, unsigned int nh_flags); |
1384 | +void fib_sync_mtu(struct net_device *dev, u32 orig_mtu); |
1385 | |
1386 | extern u32 fib_multipath_secret __read_mostly; |
1387 | |
1388 | diff --git a/include/net/ipv6.h b/include/net/ipv6.h |
1389 | index 64b0e9df31c7..7cb100d25bb5 100644 |
1390 | --- a/include/net/ipv6.h |
1391 | +++ b/include/net/ipv6.h |
1392 | @@ -330,13 +330,6 @@ static inline bool ipv6_accept_ra(struct inet6_dev *idev) |
1393 | idev->cnf.accept_ra; |
1394 | } |
1395 | |
1396 | -#if IS_ENABLED(CONFIG_IPV6) |
1397 | -static inline int ip6_frag_mem(struct net *net) |
1398 | -{ |
1399 | - return sum_frag_mem_limit(&net->ipv6.frags); |
1400 | -} |
1401 | -#endif |
1402 | - |
1403 | #define IPV6_FRAG_HIGH_THRESH (4 * 1024*1024) /* 4194304 */ |
1404 | #define IPV6_FRAG_LOW_THRESH (3 * 1024*1024) /* 3145728 */ |
1405 | #define IPV6_FRAG_TIMEOUT (60 * HZ) /* 60 seconds */ |
1406 | @@ -530,17 +523,8 @@ enum ip6_defrag_users { |
1407 | __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX, |
1408 | }; |
1409 | |
1410 | -struct ip6_create_arg { |
1411 | - __be32 id; |
1412 | - u32 user; |
1413 | - const struct in6_addr *src; |
1414 | - const struct in6_addr *dst; |
1415 | - int iif; |
1416 | - u8 ecn; |
1417 | -}; |
1418 | - |
1419 | void ip6_frag_init(struct inet_frag_queue *q, const void *a); |
1420 | -bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); |
1421 | +extern const struct rhashtable_params ip6_rhash_params; |
1422 | |
1423 | /* |
1424 | * Equivalent of ipv4 struct ip |
1425 | @@ -548,19 +532,13 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); |
1426 | struct frag_queue { |
1427 | struct inet_frag_queue q; |
1428 | |
1429 | - __be32 id; /* fragment id */ |
1430 | - u32 user; |
1431 | - struct in6_addr saddr; |
1432 | - struct in6_addr daddr; |
1433 | - |
1434 | int iif; |
1435 | unsigned int csum; |
1436 | __u16 nhoffset; |
1437 | u8 ecn; |
1438 | }; |
1439 | |
1440 | -void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, |
1441 | - struct inet_frags *frags); |
1442 | +void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq); |
1443 | |
1444 | static inline bool ipv6_addr_any(const struct in6_addr *a) |
1445 | { |
1446 | diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h |
1447 | index e7a31f830690..3442a26d36d9 100644 |
1448 | --- a/include/uapi/linux/snmp.h |
1449 | +++ b/include/uapi/linux/snmp.h |
1450 | @@ -55,6 +55,7 @@ enum |
1451 | IPSTATS_MIB_ECT1PKTS, /* InECT1Pkts */ |
1452 | IPSTATS_MIB_ECT0PKTS, /* InECT0Pkts */ |
1453 | IPSTATS_MIB_CEPKTS, /* InCEPkts */ |
1454 | + IPSTATS_MIB_REASM_OVERLAPS, /* ReasmOverlaps */ |
1455 | __IPSTATS_MIB_MAX |
1456 | }; |
1457 | |
1458 | diff --git a/lib/rhashtable.c b/lib/rhashtable.c |
1459 | index 101dac085c62..fdffd6232365 100644 |
1460 | --- a/lib/rhashtable.c |
1461 | +++ b/lib/rhashtable.c |
1462 | @@ -251,8 +251,10 @@ static int rhashtable_rehash_table(struct rhashtable *ht) |
1463 | if (!new_tbl) |
1464 | return 0; |
1465 | |
1466 | - for (old_hash = 0; old_hash < old_tbl->size; old_hash++) |
1467 | + for (old_hash = 0; old_hash < old_tbl->size; old_hash++) { |
1468 | rhashtable_rehash_chain(ht, old_hash); |
1469 | + cond_resched(); |
1470 | + } |
1471 | |
1472 | /* Publish the new table pointer. */ |
1473 | rcu_assign_pointer(ht->tbl, new_tbl); |
1474 | @@ -993,6 +995,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht, |
1475 | for (i = 0; i < tbl->size; i++) { |
1476 | struct rhash_head *pos, *next; |
1477 | |
1478 | + cond_resched(); |
1479 | for (pos = rht_dereference(tbl->buckets[i], ht), |
1480 | next = !rht_is_a_nulls(pos) ? |
1481 | rht_dereference(pos->next, ht) : NULL; |
1482 | diff --git a/mm/vmstat.c b/mm/vmstat.c |
1483 | index d31e801a467c..5e6a4d76659d 100644 |
1484 | --- a/mm/vmstat.c |
1485 | +++ b/mm/vmstat.c |
1486 | @@ -1089,7 +1089,6 @@ const char * const vmstat_text[] = { |
1487 | #ifdef CONFIG_DEBUG_VM_VMACACHE |
1488 | "vmacache_find_calls", |
1489 | "vmacache_find_hits", |
1490 | - "vmacache_full_flushes", |
1491 | #endif |
1492 | #endif /* CONFIG_VM_EVENTS_COUNTERS */ |
1493 | }; |
1494 | diff --git a/net/core/dev.c b/net/core/dev.c |
1495 | index b85e789044d5..15e3bb94156b 100644 |
1496 | --- a/net/core/dev.c |
1497 | +++ b/net/core/dev.c |
1498 | @@ -1664,6 +1664,28 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev) |
1499 | } |
1500 | EXPORT_SYMBOL(call_netdevice_notifiers); |
1501 | |
1502 | +/** |
1503 | + * call_netdevice_notifiers_mtu - call all network notifier blocks |
1504 | + * @val: value passed unmodified to notifier function |
1505 | + * @dev: net_device pointer passed unmodified to notifier function |
1506 | + * @arg: additional u32 argument passed to the notifier function |
1507 | + * |
1508 | + * Call all network notifier blocks. Parameters and return value |
1509 | + * are as for raw_notifier_call_chain(). |
1510 | + */ |
1511 | +static int call_netdevice_notifiers_mtu(unsigned long val, |
1512 | + struct net_device *dev, u32 arg) |
1513 | +{ |
1514 | + struct netdev_notifier_info_ext info = { |
1515 | + .info.dev = dev, |
1516 | + .ext.mtu = arg, |
1517 | + }; |
1518 | + |
1519 | + BUILD_BUG_ON(offsetof(struct netdev_notifier_info_ext, info) != 0); |
1520 | + |
1521 | + return call_netdevice_notifiers_info(val, dev, &info.info); |
1522 | +} |
1523 | + |
1524 | #ifdef CONFIG_NET_INGRESS |
1525 | static struct static_key ingress_needed __read_mostly; |
1526 | |
1527 | @@ -6589,14 +6611,16 @@ int dev_set_mtu(struct net_device *dev, int new_mtu) |
1528 | err = __dev_set_mtu(dev, new_mtu); |
1529 | |
1530 | if (!err) { |
1531 | - err = call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); |
1532 | + err = call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, |
1533 | + orig_mtu); |
1534 | err = notifier_to_errno(err); |
1535 | if (err) { |
1536 | /* setting mtu back and notifying everyone again, |
1537 | * so that they have a chance to revert changes. |
1538 | */ |
1539 | __dev_set_mtu(dev, orig_mtu); |
1540 | - call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); |
1541 | + call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, |
1542 | + new_mtu); |
1543 | } |
1544 | } |
1545 | return err; |
1546 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
1547 | index 194e844e1021..189082dc288d 100644 |
1548 | --- a/net/core/rtnetlink.c |
1549 | +++ b/net/core/rtnetlink.c |
1550 | @@ -2368,6 +2368,12 @@ struct net_device *rtnl_create_link(struct net *net, |
1551 | else if (ops->get_num_rx_queues) |
1552 | num_rx_queues = ops->get_num_rx_queues(); |
1553 | |
1554 | + if (num_tx_queues < 1 || num_tx_queues > 4096) |
1555 | + return ERR_PTR(-EINVAL); |
1556 | + |
1557 | + if (num_rx_queues < 1 || num_rx_queues > 4096) |
1558 | + return ERR_PTR(-EINVAL); |
1559 | + |
1560 | err = -ENOMEM; |
1561 | dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type, |
1562 | ops->setup, num_tx_queues, num_rx_queues); |
1563 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c |
1564 | index 84c731aef0d8..038ec74fa131 100644 |
1565 | --- a/net/core/skbuff.c |
1566 | +++ b/net/core/skbuff.c |
1567 | @@ -1578,6 +1578,20 @@ done: |
1568 | } |
1569 | EXPORT_SYMBOL(___pskb_trim); |
1570 | |
1571 | +/* Note : use pskb_trim_rcsum() instead of calling this directly |
1572 | + */ |
1573 | +int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) |
1574 | +{ |
1575 | + if (skb->ip_summed == CHECKSUM_COMPLETE) { |
1576 | + int delta = skb->len - len; |
1577 | + |
1578 | + skb->csum = csum_sub(skb->csum, |
1579 | + skb_checksum(skb, len, delta, 0)); |
1580 | + } |
1581 | + return __pskb_trim(skb, len); |
1582 | +} |
1583 | +EXPORT_SYMBOL(pskb_trim_rcsum_slow); |
1584 | + |
1585 | /** |
1586 | * __pskb_pull_tail - advance tail of skb header |
1587 | * @skb: buffer to reallocate |
1588 | @@ -2425,20 +2439,27 @@ EXPORT_SYMBOL(skb_queue_purge); |
1589 | /** |
1590 | * skb_rbtree_purge - empty a skb rbtree |
1591 | * @root: root of the rbtree to empty |
1592 | + * Return value: the sum of truesizes of all purged skbs. |
1593 | * |
1594 | * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from |
1595 | * the list and one reference dropped. This function does not take |
1596 | * any lock. Synchronization should be handled by the caller (e.g., TCP |
1597 | * out-of-order queue is protected by the socket lock). |
1598 | */ |
1599 | -void skb_rbtree_purge(struct rb_root *root) |
1600 | +unsigned int skb_rbtree_purge(struct rb_root *root) |
1601 | { |
1602 | - struct sk_buff *skb, *next; |
1603 | + struct rb_node *p = rb_first(root); |
1604 | + unsigned int sum = 0; |
1605 | |
1606 | - rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode) |
1607 | - kfree_skb(skb); |
1608 | + while (p) { |
1609 | + struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); |
1610 | |
1611 | - *root = RB_ROOT; |
1612 | + p = rb_next(p); |
1613 | + rb_erase(&skb->rbnode, root); |
1614 | + sum += skb->truesize; |
1615 | + kfree_skb(skb); |
1616 | + } |
1617 | + return sum; |
1618 | } |
1619 | |
1620 | /** |
1621 | diff --git a/net/dccp/input.c b/net/dccp/input.c |
1622 | index 4a05d7876850..84ff43acd427 100644 |
1623 | --- a/net/dccp/input.c |
1624 | +++ b/net/dccp/input.c |
1625 | @@ -605,11 +605,13 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, |
1626 | if (sk->sk_state == DCCP_LISTEN) { |
1627 | if (dh->dccph_type == DCCP_PKT_REQUEST) { |
1628 | /* It is possible that we process SYN packets from backlog, |
1629 | - * so we need to make sure to disable BH right there. |
1630 | + * so we need to make sure to disable BH and RCU right there. |
1631 | */ |
1632 | + rcu_read_lock(); |
1633 | local_bh_disable(); |
1634 | acceptable = inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) >= 0; |
1635 | local_bh_enable(); |
1636 | + rcu_read_unlock(); |
1637 | if (!acceptable) |
1638 | return 1; |
1639 | consume_skb(skb); |
1640 | diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c |
1641 | index 6697b180e122..28ad6f187e19 100644 |
1642 | --- a/net/dccp/ipv4.c |
1643 | +++ b/net/dccp/ipv4.c |
1644 | @@ -493,9 +493,11 @@ static int dccp_v4_send_response(const struct sock *sk, struct request_sock *req |
1645 | |
1646 | dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->ir_loc_addr, |
1647 | ireq->ir_rmt_addr); |
1648 | + rcu_read_lock(); |
1649 | err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr, |
1650 | ireq->ir_rmt_addr, |
1651 | - ireq_opt_deref(ireq)); |
1652 | + rcu_dereference(ireq->ireq_opt)); |
1653 | + rcu_read_unlock(); |
1654 | err = net_xmit_eval(err); |
1655 | } |
1656 | |
1657 | diff --git a/net/ieee802154/6lowpan/6lowpan_i.h b/net/ieee802154/6lowpan/6lowpan_i.h |
1658 | index 5ac778962e4e..3bfec472734a 100644 |
1659 | --- a/net/ieee802154/6lowpan/6lowpan_i.h |
1660 | +++ b/net/ieee802154/6lowpan/6lowpan_i.h |
1661 | @@ -16,37 +16,19 @@ typedef unsigned __bitwise__ lowpan_rx_result; |
1662 | #define LOWPAN_DISPATCH_FRAG1 0xc0 |
1663 | #define LOWPAN_DISPATCH_FRAGN 0xe0 |
1664 | |
1665 | -struct lowpan_create_arg { |
1666 | +struct frag_lowpan_compare_key { |
1667 | u16 tag; |
1668 | u16 d_size; |
1669 | - const struct ieee802154_addr *src; |
1670 | - const struct ieee802154_addr *dst; |
1671 | + const struct ieee802154_addr src; |
1672 | + const struct ieee802154_addr dst; |
1673 | }; |
1674 | |
1675 | -/* Equivalent of ipv4 struct ip |
1676 | +/* Equivalent of ipv4 struct ipq |
1677 | */ |
1678 | struct lowpan_frag_queue { |
1679 | struct inet_frag_queue q; |
1680 | - |
1681 | - u16 tag; |
1682 | - u16 d_size; |
1683 | - struct ieee802154_addr saddr; |
1684 | - struct ieee802154_addr daddr; |
1685 | }; |
1686 | |
1687 | -static inline u32 ieee802154_addr_hash(const struct ieee802154_addr *a) |
1688 | -{ |
1689 | - switch (a->mode) { |
1690 | - case IEEE802154_ADDR_LONG: |
1691 | - return (((__force u64)a->extended_addr) >> 32) ^ |
1692 | - (((__force u64)a->extended_addr) & 0xffffffff); |
1693 | - case IEEE802154_ADDR_SHORT: |
1694 | - return (__force u32)(a->short_addr + (a->pan_id << 16)); |
1695 | - default: |
1696 | - return 0; |
1697 | - } |
1698 | -} |
1699 | - |
1700 | int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type); |
1701 | void lowpan_net_frag_exit(void); |
1702 | int lowpan_net_frag_init(void); |
1703 | diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c |
1704 | index f85b08baff16..6fca75581e13 100644 |
1705 | --- a/net/ieee802154/6lowpan/reassembly.c |
1706 | +++ b/net/ieee802154/6lowpan/reassembly.c |
1707 | @@ -37,47 +37,15 @@ static struct inet_frags lowpan_frags; |
1708 | static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, |
1709 | struct sk_buff *prev, struct net_device *ldev); |
1710 | |
1711 | -static unsigned int lowpan_hash_frag(u16 tag, u16 d_size, |
1712 | - const struct ieee802154_addr *saddr, |
1713 | - const struct ieee802154_addr *daddr) |
1714 | -{ |
1715 | - net_get_random_once(&lowpan_frags.rnd, sizeof(lowpan_frags.rnd)); |
1716 | - return jhash_3words(ieee802154_addr_hash(saddr), |
1717 | - ieee802154_addr_hash(daddr), |
1718 | - (__force u32)(tag + (d_size << 16)), |
1719 | - lowpan_frags.rnd); |
1720 | -} |
1721 | - |
1722 | -static unsigned int lowpan_hashfn(const struct inet_frag_queue *q) |
1723 | -{ |
1724 | - const struct lowpan_frag_queue *fq; |
1725 | - |
1726 | - fq = container_of(q, struct lowpan_frag_queue, q); |
1727 | - return lowpan_hash_frag(fq->tag, fq->d_size, &fq->saddr, &fq->daddr); |
1728 | -} |
1729 | - |
1730 | -static bool lowpan_frag_match(const struct inet_frag_queue *q, const void *a) |
1731 | -{ |
1732 | - const struct lowpan_frag_queue *fq; |
1733 | - const struct lowpan_create_arg *arg = a; |
1734 | - |
1735 | - fq = container_of(q, struct lowpan_frag_queue, q); |
1736 | - return fq->tag == arg->tag && fq->d_size == arg->d_size && |
1737 | - ieee802154_addr_equal(&fq->saddr, arg->src) && |
1738 | - ieee802154_addr_equal(&fq->daddr, arg->dst); |
1739 | -} |
1740 | - |
1741 | static void lowpan_frag_init(struct inet_frag_queue *q, const void *a) |
1742 | { |
1743 | - const struct lowpan_create_arg *arg = a; |
1744 | + const struct frag_lowpan_compare_key *key = a; |
1745 | struct lowpan_frag_queue *fq; |
1746 | |
1747 | fq = container_of(q, struct lowpan_frag_queue, q); |
1748 | |
1749 | - fq->tag = arg->tag; |
1750 | - fq->d_size = arg->d_size; |
1751 | - fq->saddr = *arg->src; |
1752 | - fq->daddr = *arg->dst; |
1753 | + BUILD_BUG_ON(sizeof(*key) > sizeof(q->key)); |
1754 | + memcpy(&q->key, key, sizeof(*key)); |
1755 | } |
1756 | |
1757 | static void lowpan_frag_expire(unsigned long data) |
1758 | @@ -93,10 +61,10 @@ static void lowpan_frag_expire(unsigned long data) |
1759 | if (fq->q.flags & INET_FRAG_COMPLETE) |
1760 | goto out; |
1761 | |
1762 | - inet_frag_kill(&fq->q, &lowpan_frags); |
1763 | + inet_frag_kill(&fq->q); |
1764 | out: |
1765 | spin_unlock(&fq->q.lock); |
1766 | - inet_frag_put(&fq->q, &lowpan_frags); |
1767 | + inet_frag_put(&fq->q); |
1768 | } |
1769 | |
1770 | static inline struct lowpan_frag_queue * |
1771 | @@ -104,25 +72,20 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb, |
1772 | const struct ieee802154_addr *src, |
1773 | const struct ieee802154_addr *dst) |
1774 | { |
1775 | - struct inet_frag_queue *q; |
1776 | - struct lowpan_create_arg arg; |
1777 | - unsigned int hash; |
1778 | struct netns_ieee802154_lowpan *ieee802154_lowpan = |
1779 | net_ieee802154_lowpan(net); |
1780 | + struct frag_lowpan_compare_key key = { |
1781 | + .tag = cb->d_tag, |
1782 | + .d_size = cb->d_size, |
1783 | + .src = *src, |
1784 | + .dst = *dst, |
1785 | + }; |
1786 | + struct inet_frag_queue *q; |
1787 | |
1788 | - arg.tag = cb->d_tag; |
1789 | - arg.d_size = cb->d_size; |
1790 | - arg.src = src; |
1791 | - arg.dst = dst; |
1792 | - |
1793 | - hash = lowpan_hash_frag(cb->d_tag, cb->d_size, src, dst); |
1794 | - |
1795 | - q = inet_frag_find(&ieee802154_lowpan->frags, |
1796 | - &lowpan_frags, &arg, hash); |
1797 | - if (IS_ERR_OR_NULL(q)) { |
1798 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
1799 | + q = inet_frag_find(&ieee802154_lowpan->frags, &key); |
1800 | + if (!q) |
1801 | return NULL; |
1802 | - } |
1803 | + |
1804 | return container_of(q, struct lowpan_frag_queue, q); |
1805 | } |
1806 | |
1807 | @@ -229,7 +192,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev, |
1808 | struct sk_buff *fp, *head = fq->q.fragments; |
1809 | int sum_truesize; |
1810 | |
1811 | - inet_frag_kill(&fq->q, &lowpan_frags); |
1812 | + inet_frag_kill(&fq->q); |
1813 | |
1814 | /* Make the one we just received the head. */ |
1815 | if (prev) { |
1816 | @@ -437,7 +400,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) |
1817 | ret = lowpan_frag_queue(fq, skb, frag_type); |
1818 | spin_unlock(&fq->q.lock); |
1819 | |
1820 | - inet_frag_put(&fq->q, &lowpan_frags); |
1821 | + inet_frag_put(&fq->q); |
1822 | return ret; |
1823 | } |
1824 | |
1825 | @@ -447,24 +410,22 @@ err: |
1826 | } |
1827 | |
1828 | #ifdef CONFIG_SYSCTL |
1829 | -static int zero; |
1830 | |
1831 | static struct ctl_table lowpan_frags_ns_ctl_table[] = { |
1832 | { |
1833 | .procname = "6lowpanfrag_high_thresh", |
1834 | .data = &init_net.ieee802154_lowpan.frags.high_thresh, |
1835 | - .maxlen = sizeof(int), |
1836 | + .maxlen = sizeof(unsigned long), |
1837 | .mode = 0644, |
1838 | - .proc_handler = proc_dointvec_minmax, |
1839 | + .proc_handler = proc_doulongvec_minmax, |
1840 | .extra1 = &init_net.ieee802154_lowpan.frags.low_thresh |
1841 | }, |
1842 | { |
1843 | .procname = "6lowpanfrag_low_thresh", |
1844 | .data = &init_net.ieee802154_lowpan.frags.low_thresh, |
1845 | - .maxlen = sizeof(int), |
1846 | + .maxlen = sizeof(unsigned long), |
1847 | .mode = 0644, |
1848 | - .proc_handler = proc_dointvec_minmax, |
1849 | - .extra1 = &zero, |
1850 | + .proc_handler = proc_doulongvec_minmax, |
1851 | .extra2 = &init_net.ieee802154_lowpan.frags.high_thresh |
1852 | }, |
1853 | { |
1854 | @@ -580,14 +541,20 @@ static int __net_init lowpan_frags_init_net(struct net *net) |
1855 | { |
1856 | struct netns_ieee802154_lowpan *ieee802154_lowpan = |
1857 | net_ieee802154_lowpan(net); |
1858 | + int res; |
1859 | |
1860 | ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; |
1861 | ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; |
1862 | ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; |
1863 | + ieee802154_lowpan->frags.f = &lowpan_frags; |
1864 | |
1865 | - inet_frags_init_net(&ieee802154_lowpan->frags); |
1866 | - |
1867 | - return lowpan_frags_ns_sysctl_register(net); |
1868 | + res = inet_frags_init_net(&ieee802154_lowpan->frags); |
1869 | + if (res < 0) |
1870 | + return res; |
1871 | + res = lowpan_frags_ns_sysctl_register(net); |
1872 | + if (res < 0) |
1873 | + inet_frags_exit_net(&ieee802154_lowpan->frags); |
1874 | + return res; |
1875 | } |
1876 | |
1877 | static void __net_exit lowpan_frags_exit_net(struct net *net) |
1878 | @@ -596,7 +563,7 @@ static void __net_exit lowpan_frags_exit_net(struct net *net) |
1879 | net_ieee802154_lowpan(net); |
1880 | |
1881 | lowpan_frags_ns_sysctl_unregister(net); |
1882 | - inet_frags_exit_net(&ieee802154_lowpan->frags, &lowpan_frags); |
1883 | + inet_frags_exit_net(&ieee802154_lowpan->frags); |
1884 | } |
1885 | |
1886 | static struct pernet_operations lowpan_frags_ops = { |
1887 | @@ -604,32 +571,63 @@ static struct pernet_operations lowpan_frags_ops = { |
1888 | .exit = lowpan_frags_exit_net, |
1889 | }; |
1890 | |
1891 | -int __init lowpan_net_frag_init(void) |
1892 | +static u32 lowpan_key_hashfn(const void *data, u32 len, u32 seed) |
1893 | { |
1894 | - int ret; |
1895 | + return jhash2(data, |
1896 | + sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); |
1897 | +} |
1898 | |
1899 | - ret = lowpan_frags_sysctl_register(); |
1900 | - if (ret) |
1901 | - return ret; |
1902 | +static u32 lowpan_obj_hashfn(const void *data, u32 len, u32 seed) |
1903 | +{ |
1904 | + const struct inet_frag_queue *fq = data; |
1905 | |
1906 | - ret = register_pernet_subsys(&lowpan_frags_ops); |
1907 | - if (ret) |
1908 | - goto err_pernet; |
1909 | + return jhash2((const u32 *)&fq->key, |
1910 | + sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); |
1911 | +} |
1912 | + |
1913 | +static int lowpan_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) |
1914 | +{ |
1915 | + const struct frag_lowpan_compare_key *key = arg->key; |
1916 | + const struct inet_frag_queue *fq = ptr; |
1917 | + |
1918 | + return !!memcmp(&fq->key, key, sizeof(*key)); |
1919 | +} |
1920 | + |
1921 | +static const struct rhashtable_params lowpan_rhash_params = { |
1922 | + .head_offset = offsetof(struct inet_frag_queue, node), |
1923 | + .hashfn = lowpan_key_hashfn, |
1924 | + .obj_hashfn = lowpan_obj_hashfn, |
1925 | + .obj_cmpfn = lowpan_obj_cmpfn, |
1926 | + .automatic_shrinking = true, |
1927 | +}; |
1928 | + |
1929 | +int __init lowpan_net_frag_init(void) |
1930 | +{ |
1931 | + int ret; |
1932 | |
1933 | - lowpan_frags.hashfn = lowpan_hashfn; |
1934 | lowpan_frags.constructor = lowpan_frag_init; |
1935 | lowpan_frags.destructor = NULL; |
1936 | lowpan_frags.qsize = sizeof(struct frag_queue); |
1937 | - lowpan_frags.match = lowpan_frag_match; |
1938 | lowpan_frags.frag_expire = lowpan_frag_expire; |
1939 | lowpan_frags.frags_cache_name = lowpan_frags_cache_name; |
1940 | + lowpan_frags.rhash_params = lowpan_rhash_params; |
1941 | ret = inet_frags_init(&lowpan_frags); |
1942 | if (ret) |
1943 | - goto err_pernet; |
1944 | + goto out; |
1945 | |
1946 | + ret = lowpan_frags_sysctl_register(); |
1947 | + if (ret) |
1948 | + goto err_sysctl; |
1949 | + |
1950 | + ret = register_pernet_subsys(&lowpan_frags_ops); |
1951 | + if (ret) |
1952 | + goto err_pernet; |
1953 | +out: |
1954 | return ret; |
1955 | err_pernet: |
1956 | lowpan_frags_sysctl_unregister(); |
1957 | +err_sysctl: |
1958 | + inet_frags_fini(&lowpan_frags); |
1959 | return ret; |
1960 | } |
1961 | |
1962 | diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c |
1963 | index 6a2ef162088d..9364c39d0555 100644 |
1964 | --- a/net/ipv4/fib_frontend.c |
1965 | +++ b/net/ipv4/fib_frontend.c |
1966 | @@ -1171,7 +1171,8 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, |
1967 | static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) |
1968 | { |
1969 | struct net_device *dev = netdev_notifier_info_to_dev(ptr); |
1970 | - struct netdev_notifier_changeupper_info *info; |
1971 | + struct netdev_notifier_changeupper_info *upper_info = ptr; |
1972 | + struct netdev_notifier_info_ext *info_ext = ptr; |
1973 | struct in_device *in_dev; |
1974 | struct net *net = dev_net(dev); |
1975 | unsigned int flags; |
1976 | @@ -1206,16 +1207,19 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo |
1977 | fib_sync_up(dev, RTNH_F_LINKDOWN); |
1978 | else |
1979 | fib_sync_down_dev(dev, event, false); |
1980 | - /* fall through */ |
1981 | + rt_cache_flush(net); |
1982 | + break; |
1983 | case NETDEV_CHANGEMTU: |
1984 | + fib_sync_mtu(dev, info_ext->ext.mtu); |
1985 | rt_cache_flush(net); |
1986 | break; |
1987 | case NETDEV_CHANGEUPPER: |
1988 | - info = ptr; |
1989 | + upper_info = ptr; |
1990 | /* flush all routes if dev is linked to or unlinked from |
1991 | * an L3 master device (e.g., VRF) |
1992 | */ |
1993 | - if (info->upper_dev && netif_is_l3_master(info->upper_dev)) |
1994 | + if (upper_info->upper_dev && |
1995 | + netif_is_l3_master(upper_info->upper_dev)) |
1996 | fib_disable_ip(dev, NETDEV_DOWN, true); |
1997 | break; |
1998 | } |
1999 | diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c |
2000 | index a88dab33cdf6..90c654012510 100644 |
2001 | --- a/net/ipv4/fib_semantics.c |
2002 | +++ b/net/ipv4/fib_semantics.c |
2003 | @@ -1377,6 +1377,56 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local) |
2004 | return ret; |
2005 | } |
2006 | |
2007 | +/* Update the PMTU of exceptions when: |
2008 | + * - the new MTU of the first hop becomes smaller than the PMTU |
2009 | + * - the old MTU was the same as the PMTU, and it limited discovery of |
2010 | + * larger MTUs on the path. With that limit raised, we can now |
2011 | + * discover larger MTUs |
2012 | + * A special case is locked exceptions, for which the PMTU is smaller |
2013 | + * than the minimal accepted PMTU: |
2014 | + * - if the new MTU is greater than the PMTU, don't make any change |
2015 | + * - otherwise, unlock and set PMTU |
2016 | + */ |
2017 | +static void nh_update_mtu(struct fib_nh *nh, u32 new, u32 orig) |
2018 | +{ |
2019 | + struct fnhe_hash_bucket *bucket; |
2020 | + int i; |
2021 | + |
2022 | + bucket = rcu_dereference_protected(nh->nh_exceptions, 1); |
2023 | + if (!bucket) |
2024 | + return; |
2025 | + |
2026 | + for (i = 0; i < FNHE_HASH_SIZE; i++) { |
2027 | + struct fib_nh_exception *fnhe; |
2028 | + |
2029 | + for (fnhe = rcu_dereference_protected(bucket[i].chain, 1); |
2030 | + fnhe; |
2031 | + fnhe = rcu_dereference_protected(fnhe->fnhe_next, 1)) { |
2032 | + if (fnhe->fnhe_mtu_locked) { |
2033 | + if (new <= fnhe->fnhe_pmtu) { |
2034 | + fnhe->fnhe_pmtu = new; |
2035 | + fnhe->fnhe_mtu_locked = false; |
2036 | + } |
2037 | + } else if (new < fnhe->fnhe_pmtu || |
2038 | + orig == fnhe->fnhe_pmtu) { |
2039 | + fnhe->fnhe_pmtu = new; |
2040 | + } |
2041 | + } |
2042 | + } |
2043 | +} |
2044 | + |
2045 | +void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) |
2046 | +{ |
2047 | + unsigned int hash = fib_devindex_hashfn(dev->ifindex); |
2048 | + struct hlist_head *head = &fib_info_devhash[hash]; |
2049 | + struct fib_nh *nh; |
2050 | + |
2051 | + hlist_for_each_entry(nh, head, nh_hash) { |
2052 | + if (nh->nh_dev == dev) |
2053 | + nh_update_mtu(nh, dev->mtu, orig_mtu); |
2054 | + } |
2055 | +} |
2056 | + |
2057 | /* Event force Flags Description |
2058 | * NETDEV_CHANGE 0 LINKDOWN Carrier OFF, not for scope host |
2059 | * NETDEV_DOWN 0 LINKDOWN|DEAD Link down, not for scope host |
2060 | diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c |
2061 | index d1cab49393e2..528a6777cda0 100644 |
2062 | --- a/net/ipv4/inet_connection_sock.c |
2063 | +++ b/net/ipv4/inet_connection_sock.c |
2064 | @@ -410,7 +410,8 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk, |
2065 | struct ip_options_rcu *opt; |
2066 | struct rtable *rt; |
2067 | |
2068 | - opt = ireq_opt_deref(ireq); |
2069 | + rcu_read_lock(); |
2070 | + opt = rcu_dereference(ireq->ireq_opt); |
2071 | |
2072 | flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark, |
2073 | RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, |
2074 | @@ -424,11 +425,13 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk, |
2075 | goto no_route; |
2076 | if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) |
2077 | goto route_err; |
2078 | + rcu_read_unlock(); |
2079 | return &rt->dst; |
2080 | |
2081 | route_err: |
2082 | ip_rt_put(rt); |
2083 | no_route: |
2084 | + rcu_read_unlock(); |
2085 | __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES); |
2086 | return NULL; |
2087 | } |
2088 | diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c |
2089 | index f8b41aaac76f..8323d33c0ce2 100644 |
2090 | --- a/net/ipv4/inet_fragment.c |
2091 | +++ b/net/ipv4/inet_fragment.c |
2092 | @@ -25,12 +25,6 @@ |
2093 | #include <net/inet_frag.h> |
2094 | #include <net/inet_ecn.h> |
2095 | |
2096 | -#define INETFRAGS_EVICT_BUCKETS 128 |
2097 | -#define INETFRAGS_EVICT_MAX 512 |
2098 | - |
2099 | -/* don't rebuild inetfrag table with new secret more often than this */ |
2100 | -#define INETFRAGS_MIN_REBUILD_INTERVAL (5 * HZ) |
2101 | - |
2102 | /* Given the OR values of all fragments, apply RFC 3168 5.3 requirements |
2103 | * Value : 0xff if frame should be dropped. |
2104 | * 0 or INET_ECN_CE value, to be ORed in to final iph->tos field |
2105 | @@ -52,157 +46,8 @@ const u8 ip_frag_ecn_table[16] = { |
2106 | }; |
2107 | EXPORT_SYMBOL(ip_frag_ecn_table); |
2108 | |
2109 | -static unsigned int |
2110 | -inet_frag_hashfn(const struct inet_frags *f, const struct inet_frag_queue *q) |
2111 | -{ |
2112 | - return f->hashfn(q) & (INETFRAGS_HASHSZ - 1); |
2113 | -} |
2114 | - |
2115 | -static bool inet_frag_may_rebuild(struct inet_frags *f) |
2116 | -{ |
2117 | - return time_after(jiffies, |
2118 | - f->last_rebuild_jiffies + INETFRAGS_MIN_REBUILD_INTERVAL); |
2119 | -} |
2120 | - |
2121 | -static void inet_frag_secret_rebuild(struct inet_frags *f) |
2122 | -{ |
2123 | - int i; |
2124 | - |
2125 | - write_seqlock_bh(&f->rnd_seqlock); |
2126 | - |
2127 | - if (!inet_frag_may_rebuild(f)) |
2128 | - goto out; |
2129 | - |
2130 | - get_random_bytes(&f->rnd, sizeof(u32)); |
2131 | - |
2132 | - for (i = 0; i < INETFRAGS_HASHSZ; i++) { |
2133 | - struct inet_frag_bucket *hb; |
2134 | - struct inet_frag_queue *q; |
2135 | - struct hlist_node *n; |
2136 | - |
2137 | - hb = &f->hash[i]; |
2138 | - spin_lock(&hb->chain_lock); |
2139 | - |
2140 | - hlist_for_each_entry_safe(q, n, &hb->chain, list) { |
2141 | - unsigned int hval = inet_frag_hashfn(f, q); |
2142 | - |
2143 | - if (hval != i) { |
2144 | - struct inet_frag_bucket *hb_dest; |
2145 | - |
2146 | - hlist_del(&q->list); |
2147 | - |
2148 | - /* Relink to new hash chain. */ |
2149 | - hb_dest = &f->hash[hval]; |
2150 | - |
2151 | - /* This is the only place where we take |
2152 | - * another chain_lock while already holding |
2153 | - * one. As this will not run concurrently, |
2154 | - * we cannot deadlock on hb_dest lock below, if its |
2155 | - * already locked it will be released soon since |
2156 | - * other caller cannot be waiting for hb lock |
2157 | - * that we've taken above. |
2158 | - */ |
2159 | - spin_lock_nested(&hb_dest->chain_lock, |
2160 | - SINGLE_DEPTH_NESTING); |
2161 | - hlist_add_head(&q->list, &hb_dest->chain); |
2162 | - spin_unlock(&hb_dest->chain_lock); |
2163 | - } |
2164 | - } |
2165 | - spin_unlock(&hb->chain_lock); |
2166 | - } |
2167 | - |
2168 | - f->rebuild = false; |
2169 | - f->last_rebuild_jiffies = jiffies; |
2170 | -out: |
2171 | - write_sequnlock_bh(&f->rnd_seqlock); |
2172 | -} |
2173 | - |
2174 | -static bool inet_fragq_should_evict(const struct inet_frag_queue *q) |
2175 | -{ |
2176 | - if (!hlist_unhashed(&q->list_evictor)) |
2177 | - return false; |
2178 | - |
2179 | - return q->net->low_thresh == 0 || |
2180 | - frag_mem_limit(q->net) >= q->net->low_thresh; |
2181 | -} |
2182 | - |
2183 | -static unsigned int |
2184 | -inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb) |
2185 | -{ |
2186 | - struct inet_frag_queue *fq; |
2187 | - struct hlist_node *n; |
2188 | - unsigned int evicted = 0; |
2189 | - HLIST_HEAD(expired); |
2190 | - |
2191 | - spin_lock(&hb->chain_lock); |
2192 | - |
2193 | - hlist_for_each_entry_safe(fq, n, &hb->chain, list) { |
2194 | - if (!inet_fragq_should_evict(fq)) |
2195 | - continue; |
2196 | - |
2197 | - if (!del_timer(&fq->timer)) |
2198 | - continue; |
2199 | - |
2200 | - hlist_add_head(&fq->list_evictor, &expired); |
2201 | - ++evicted; |
2202 | - } |
2203 | - |
2204 | - spin_unlock(&hb->chain_lock); |
2205 | - |
2206 | - hlist_for_each_entry_safe(fq, n, &expired, list_evictor) |
2207 | - f->frag_expire((unsigned long) fq); |
2208 | - |
2209 | - return evicted; |
2210 | -} |
2211 | - |
2212 | -static void inet_frag_worker(struct work_struct *work) |
2213 | -{ |
2214 | - unsigned int budget = INETFRAGS_EVICT_BUCKETS; |
2215 | - unsigned int i, evicted = 0; |
2216 | - struct inet_frags *f; |
2217 | - |
2218 | - f = container_of(work, struct inet_frags, frags_work); |
2219 | - |
2220 | - BUILD_BUG_ON(INETFRAGS_EVICT_BUCKETS >= INETFRAGS_HASHSZ); |
2221 | - |
2222 | - local_bh_disable(); |
2223 | - |
2224 | - for (i = ACCESS_ONCE(f->next_bucket); budget; --budget) { |
2225 | - evicted += inet_evict_bucket(f, &f->hash[i]); |
2226 | - i = (i + 1) & (INETFRAGS_HASHSZ - 1); |
2227 | - if (evicted > INETFRAGS_EVICT_MAX) |
2228 | - break; |
2229 | - } |
2230 | - |
2231 | - f->next_bucket = i; |
2232 | - |
2233 | - local_bh_enable(); |
2234 | - |
2235 | - if (f->rebuild && inet_frag_may_rebuild(f)) |
2236 | - inet_frag_secret_rebuild(f); |
2237 | -} |
2238 | - |
2239 | -static void inet_frag_schedule_worker(struct inet_frags *f) |
2240 | -{ |
2241 | - if (unlikely(!work_pending(&f->frags_work))) |
2242 | - schedule_work(&f->frags_work); |
2243 | -} |
2244 | - |
2245 | int inet_frags_init(struct inet_frags *f) |
2246 | { |
2247 | - int i; |
2248 | - |
2249 | - INIT_WORK(&f->frags_work, inet_frag_worker); |
2250 | - |
2251 | - for (i = 0; i < INETFRAGS_HASHSZ; i++) { |
2252 | - struct inet_frag_bucket *hb = &f->hash[i]; |
2253 | - |
2254 | - spin_lock_init(&hb->chain_lock); |
2255 | - INIT_HLIST_HEAD(&hb->chain); |
2256 | - } |
2257 | - |
2258 | - seqlock_init(&f->rnd_seqlock); |
2259 | - f->last_rebuild_jiffies = 0; |
2260 | f->frags_cachep = kmem_cache_create(f->frags_cache_name, f->qsize, 0, 0, |
2261 | NULL); |
2262 | if (!f->frags_cachep) |
2263 | @@ -214,83 +59,75 @@ EXPORT_SYMBOL(inet_frags_init); |
2264 | |
2265 | void inet_frags_fini(struct inet_frags *f) |
2266 | { |
2267 | - cancel_work_sync(&f->frags_work); |
2268 | + /* We must wait that all inet_frag_destroy_rcu() have completed. */ |
2269 | + rcu_barrier(); |
2270 | + |
2271 | kmem_cache_destroy(f->frags_cachep); |
2272 | + f->frags_cachep = NULL; |
2273 | } |
2274 | EXPORT_SYMBOL(inet_frags_fini); |
2275 | |
2276 | -void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f) |
2277 | +static void inet_frags_free_cb(void *ptr, void *arg) |
2278 | { |
2279 | - unsigned int seq; |
2280 | - int i; |
2281 | - |
2282 | - nf->low_thresh = 0; |
2283 | - |
2284 | -evict_again: |
2285 | - local_bh_disable(); |
2286 | - seq = read_seqbegin(&f->rnd_seqlock); |
2287 | + struct inet_frag_queue *fq = ptr; |
2288 | |
2289 | - for (i = 0; i < INETFRAGS_HASHSZ ; i++) |
2290 | - inet_evict_bucket(f, &f->hash[i]); |
2291 | - |
2292 | - local_bh_enable(); |
2293 | - cond_resched(); |
2294 | - |
2295 | - if (read_seqretry(&f->rnd_seqlock, seq) || |
2296 | - sum_frag_mem_limit(nf)) |
2297 | - goto evict_again; |
2298 | -} |
2299 | -EXPORT_SYMBOL(inet_frags_exit_net); |
2300 | - |
2301 | -static struct inet_frag_bucket * |
2302 | -get_frag_bucket_locked(struct inet_frag_queue *fq, struct inet_frags *f) |
2303 | -__acquires(hb->chain_lock) |
2304 | -{ |
2305 | - struct inet_frag_bucket *hb; |
2306 | - unsigned int seq, hash; |
2307 | - |
2308 | - restart: |
2309 | - seq = read_seqbegin(&f->rnd_seqlock); |
2310 | - |
2311 | - hash = inet_frag_hashfn(f, fq); |
2312 | - hb = &f->hash[hash]; |
2313 | + /* If we can not cancel the timer, it means this frag_queue |
2314 | + * is already disappearing, we have nothing to do. |
2315 | + * Otherwise, we own a refcount until the end of this function. |
2316 | + */ |
2317 | + if (!del_timer(&fq->timer)) |
2318 | + return; |
2319 | |
2320 | - spin_lock(&hb->chain_lock); |
2321 | - if (read_seqretry(&f->rnd_seqlock, seq)) { |
2322 | - spin_unlock(&hb->chain_lock); |
2323 | - goto restart; |
2324 | + spin_lock_bh(&fq->lock); |
2325 | + if (!(fq->flags & INET_FRAG_COMPLETE)) { |
2326 | + fq->flags |= INET_FRAG_COMPLETE; |
2327 | + atomic_dec(&fq->refcnt); |
2328 | } |
2329 | + spin_unlock_bh(&fq->lock); |
2330 | |
2331 | - return hb; |
2332 | + inet_frag_put(fq); |
2333 | } |
2334 | |
2335 | -static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f) |
2336 | +void inet_frags_exit_net(struct netns_frags *nf) |
2337 | { |
2338 | - struct inet_frag_bucket *hb; |
2339 | + nf->low_thresh = 0; /* prevent creation of new frags */ |
2340 | |
2341 | - hb = get_frag_bucket_locked(fq, f); |
2342 | - hlist_del(&fq->list); |
2343 | - fq->flags |= INET_FRAG_COMPLETE; |
2344 | - spin_unlock(&hb->chain_lock); |
2345 | + rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL); |
2346 | } |
2347 | +EXPORT_SYMBOL(inet_frags_exit_net); |
2348 | |
2349 | -void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f) |
2350 | +void inet_frag_kill(struct inet_frag_queue *fq) |
2351 | { |
2352 | if (del_timer(&fq->timer)) |
2353 | atomic_dec(&fq->refcnt); |
2354 | |
2355 | if (!(fq->flags & INET_FRAG_COMPLETE)) { |
2356 | - fq_unlink(fq, f); |
2357 | + struct netns_frags *nf = fq->net; |
2358 | + |
2359 | + fq->flags |= INET_FRAG_COMPLETE; |
2360 | + rhashtable_remove_fast(&nf->rhashtable, &fq->node, nf->f->rhash_params); |
2361 | atomic_dec(&fq->refcnt); |
2362 | } |
2363 | } |
2364 | EXPORT_SYMBOL(inet_frag_kill); |
2365 | |
2366 | -void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) |
2367 | +static void inet_frag_destroy_rcu(struct rcu_head *head) |
2368 | +{ |
2369 | + struct inet_frag_queue *q = container_of(head, struct inet_frag_queue, |
2370 | + rcu); |
2371 | + struct inet_frags *f = q->net->f; |
2372 | + |
2373 | + if (f->destructor) |
2374 | + f->destructor(q); |
2375 | + kmem_cache_free(f->frags_cachep, q); |
2376 | +} |
2377 | + |
2378 | +void inet_frag_destroy(struct inet_frag_queue *q) |
2379 | { |
2380 | struct sk_buff *fp; |
2381 | struct netns_frags *nf; |
2382 | unsigned int sum, sum_truesize = 0; |
2383 | + struct inet_frags *f; |
2384 | |
2385 | WARN_ON(!(q->flags & INET_FRAG_COMPLETE)); |
2386 | WARN_ON(del_timer(&q->timer) != 0); |
2387 | @@ -298,64 +135,35 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) |
2388 | /* Release all fragment data. */ |
2389 | fp = q->fragments; |
2390 | nf = q->net; |
2391 | - while (fp) { |
2392 | - struct sk_buff *xp = fp->next; |
2393 | - |
2394 | - sum_truesize += fp->truesize; |
2395 | - kfree_skb(fp); |
2396 | - fp = xp; |
2397 | + f = nf->f; |
2398 | + if (fp) { |
2399 | + do { |
2400 | + struct sk_buff *xp = fp->next; |
2401 | + |
2402 | + sum_truesize += fp->truesize; |
2403 | + kfree_skb(fp); |
2404 | + fp = xp; |
2405 | + } while (fp); |
2406 | + } else { |
2407 | + sum_truesize = inet_frag_rbtree_purge(&q->rb_fragments); |
2408 | } |
2409 | sum = sum_truesize + f->qsize; |
2410 | |
2411 | - if (f->destructor) |
2412 | - f->destructor(q); |
2413 | - kmem_cache_free(f->frags_cachep, q); |
2414 | + call_rcu(&q->rcu, inet_frag_destroy_rcu); |
2415 | |
2416 | sub_frag_mem_limit(nf, sum); |
2417 | } |
2418 | EXPORT_SYMBOL(inet_frag_destroy); |
2419 | |
2420 | -static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf, |
2421 | - struct inet_frag_queue *qp_in, |
2422 | - struct inet_frags *f, |
2423 | - void *arg) |
2424 | -{ |
2425 | - struct inet_frag_bucket *hb = get_frag_bucket_locked(qp_in, f); |
2426 | - struct inet_frag_queue *qp; |
2427 | - |
2428 | -#ifdef CONFIG_SMP |
2429 | - /* With SMP race we have to recheck hash table, because |
2430 | - * such entry could have been created on other cpu before |
2431 | - * we acquired hash bucket lock. |
2432 | - */ |
2433 | - hlist_for_each_entry(qp, &hb->chain, list) { |
2434 | - if (qp->net == nf && f->match(qp, arg)) { |
2435 | - atomic_inc(&qp->refcnt); |
2436 | - spin_unlock(&hb->chain_lock); |
2437 | - qp_in->flags |= INET_FRAG_COMPLETE; |
2438 | - inet_frag_put(qp_in, f); |
2439 | - return qp; |
2440 | - } |
2441 | - } |
2442 | -#endif |
2443 | - qp = qp_in; |
2444 | - if (!mod_timer(&qp->timer, jiffies + nf->timeout)) |
2445 | - atomic_inc(&qp->refcnt); |
2446 | - |
2447 | - atomic_inc(&qp->refcnt); |
2448 | - hlist_add_head(&qp->list, &hb->chain); |
2449 | - |
2450 | - spin_unlock(&hb->chain_lock); |
2451 | - |
2452 | - return qp; |
2453 | -} |
2454 | - |
2455 | static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, |
2456 | struct inet_frags *f, |
2457 | void *arg) |
2458 | { |
2459 | struct inet_frag_queue *q; |
2460 | |
2461 | + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) |
2462 | + return NULL; |
2463 | + |
2464 | q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); |
2465 | if (!q) |
2466 | return NULL; |
2467 | @@ -366,75 +174,50 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, |
2468 | |
2469 | setup_timer(&q->timer, f->frag_expire, (unsigned long)q); |
2470 | spin_lock_init(&q->lock); |
2471 | - atomic_set(&q->refcnt, 1); |
2472 | + atomic_set(&q->refcnt, 3); |
2473 | |
2474 | return q; |
2475 | } |
2476 | |
2477 | static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, |
2478 | - struct inet_frags *f, |
2479 | void *arg) |
2480 | { |
2481 | + struct inet_frags *f = nf->f; |
2482 | struct inet_frag_queue *q; |
2483 | + int err; |
2484 | |
2485 | q = inet_frag_alloc(nf, f, arg); |
2486 | if (!q) |
2487 | return NULL; |
2488 | |
2489 | - return inet_frag_intern(nf, q, f, arg); |
2490 | -} |
2491 | + mod_timer(&q->timer, jiffies + nf->timeout); |
2492 | |
2493 | -struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, |
2494 | - struct inet_frags *f, void *key, |
2495 | - unsigned int hash) |
2496 | -{ |
2497 | - struct inet_frag_bucket *hb; |
2498 | - struct inet_frag_queue *q; |
2499 | - int depth = 0; |
2500 | - |
2501 | - if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { |
2502 | - inet_frag_schedule_worker(f); |
2503 | + err = rhashtable_insert_fast(&nf->rhashtable, &q->node, |
2504 | + f->rhash_params); |
2505 | + if (err < 0) { |
2506 | + q->flags |= INET_FRAG_COMPLETE; |
2507 | + inet_frag_kill(q); |
2508 | + inet_frag_destroy(q); |
2509 | return NULL; |
2510 | } |
2511 | - |
2512 | - if (frag_mem_limit(nf) > nf->low_thresh) |
2513 | - inet_frag_schedule_worker(f); |
2514 | - |
2515 | - hash &= (INETFRAGS_HASHSZ - 1); |
2516 | - hb = &f->hash[hash]; |
2517 | - |
2518 | - spin_lock(&hb->chain_lock); |
2519 | - hlist_for_each_entry(q, &hb->chain, list) { |
2520 | - if (q->net == nf && f->match(q, key)) { |
2521 | - atomic_inc(&q->refcnt); |
2522 | - spin_unlock(&hb->chain_lock); |
2523 | - return q; |
2524 | - } |
2525 | - depth++; |
2526 | - } |
2527 | - spin_unlock(&hb->chain_lock); |
2528 | - |
2529 | - if (depth <= INETFRAGS_MAXDEPTH) |
2530 | - return inet_frag_create(nf, f, key); |
2531 | - |
2532 | - if (inet_frag_may_rebuild(f)) { |
2533 | - if (!f->rebuild) |
2534 | - f->rebuild = true; |
2535 | - inet_frag_schedule_worker(f); |
2536 | - } |
2537 | - |
2538 | - return ERR_PTR(-ENOBUFS); |
2539 | + return q; |
2540 | } |
2541 | -EXPORT_SYMBOL(inet_frag_find); |
2542 | +EXPORT_SYMBOL(inet_frag_create); |
2543 | |
2544 | -void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, |
2545 | - const char *prefix) |
2546 | +/* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ |
2547 | +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key) |
2548 | { |
2549 | - static const char msg[] = "inet_frag_find: Fragment hash bucket" |
2550 | - " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH) |
2551 | - ". Dropping fragment.\n"; |
2552 | + struct inet_frag_queue *fq; |
2553 | |
2554 | - if (PTR_ERR(q) == -ENOBUFS) |
2555 | - net_dbg_ratelimited("%s%s", prefix, msg); |
2556 | + rcu_read_lock(); |
2557 | + fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params); |
2558 | + if (fq) { |
2559 | + if (!atomic_inc_not_zero(&fq->refcnt)) |
2560 | + fq = NULL; |
2561 | + rcu_read_unlock(); |
2562 | + return fq; |
2563 | + } |
2564 | + rcu_read_unlock(); |
2565 | + return inet_frag_create(nf, key); |
2566 | } |
2567 | -EXPORT_SYMBOL(inet_frag_maybe_warn_overflow); |
2568 | +EXPORT_SYMBOL(inet_frag_find); |
2569 | diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c |
2570 | index 752711cd4834..cc8c6ac84d08 100644 |
2571 | --- a/net/ipv4/ip_fragment.c |
2572 | +++ b/net/ipv4/ip_fragment.c |
2573 | @@ -56,27 +56,64 @@ |
2574 | */ |
2575 | static const char ip_frag_cache_name[] = "ip4-frags"; |
2576 | |
2577 | -struct ipfrag_skb_cb |
2578 | -{ |
2579 | +/* Use skb->cb to track consecutive/adjacent fragments coming at |
2580 | + * the end of the queue. Nodes in the rb-tree queue will |
2581 | + * contain "runs" of one or more adjacent fragments. |
2582 | + * |
2583 | + * Invariants: |
2584 | + * - next_frag is NULL at the tail of a "run"; |
2585 | + * - the head of a "run" has the sum of all fragment lengths in frag_run_len. |
2586 | + */ |
2587 | +struct ipfrag_skb_cb { |
2588 | struct inet_skb_parm h; |
2589 | - int offset; |
2590 | + struct sk_buff *next_frag; |
2591 | + int frag_run_len; |
2592 | }; |
2593 | |
2594 | -#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) |
2595 | +#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) |
2596 | + |
2597 | +static void ip4_frag_init_run(struct sk_buff *skb) |
2598 | +{ |
2599 | + BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb)); |
2600 | + |
2601 | + FRAG_CB(skb)->next_frag = NULL; |
2602 | + FRAG_CB(skb)->frag_run_len = skb->len; |
2603 | +} |
2604 | + |
2605 | +/* Append skb to the last "run". */ |
2606 | +static void ip4_frag_append_to_last_run(struct inet_frag_queue *q, |
2607 | + struct sk_buff *skb) |
2608 | +{ |
2609 | + RB_CLEAR_NODE(&skb->rbnode); |
2610 | + FRAG_CB(skb)->next_frag = NULL; |
2611 | + |
2612 | + FRAG_CB(q->last_run_head)->frag_run_len += skb->len; |
2613 | + FRAG_CB(q->fragments_tail)->next_frag = skb; |
2614 | + q->fragments_tail = skb; |
2615 | +} |
2616 | + |
2617 | +/* Create a new "run" with the skb. */ |
2618 | +static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb) |
2619 | +{ |
2620 | + if (q->last_run_head) |
2621 | + rb_link_node(&skb->rbnode, &q->last_run_head->rbnode, |
2622 | + &q->last_run_head->rbnode.rb_right); |
2623 | + else |
2624 | + rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node); |
2625 | + rb_insert_color(&skb->rbnode, &q->rb_fragments); |
2626 | + |
2627 | + ip4_frag_init_run(skb); |
2628 | + q->fragments_tail = skb; |
2629 | + q->last_run_head = skb; |
2630 | +} |
2631 | |
2632 | /* Describe an entry in the "incomplete datagrams" queue. */ |
2633 | struct ipq { |
2634 | struct inet_frag_queue q; |
2635 | |
2636 | - u32 user; |
2637 | - __be32 saddr; |
2638 | - __be32 daddr; |
2639 | - __be16 id; |
2640 | - u8 protocol; |
2641 | u8 ecn; /* RFC3168 support */ |
2642 | u16 max_df_size; /* largest frag with DF set seen */ |
2643 | int iif; |
2644 | - int vif; /* L3 master device index */ |
2645 | unsigned int rid; |
2646 | struct inet_peer *peer; |
2647 | }; |
2648 | @@ -88,49 +125,9 @@ static u8 ip4_frag_ecn(u8 tos) |
2649 | |
2650 | static struct inet_frags ip4_frags; |
2651 | |
2652 | -int ip_frag_mem(struct net *net) |
2653 | -{ |
2654 | - return sum_frag_mem_limit(&net->ipv4.frags); |
2655 | -} |
2656 | - |
2657 | -static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
2658 | - struct net_device *dev); |
2659 | - |
2660 | -struct ip4_create_arg { |
2661 | - struct iphdr *iph; |
2662 | - u32 user; |
2663 | - int vif; |
2664 | -}; |
2665 | +static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, |
2666 | + struct sk_buff *prev_tail, struct net_device *dev); |
2667 | |
2668 | -static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) |
2669 | -{ |
2670 | - net_get_random_once(&ip4_frags.rnd, sizeof(ip4_frags.rnd)); |
2671 | - return jhash_3words((__force u32)id << 16 | prot, |
2672 | - (__force u32)saddr, (__force u32)daddr, |
2673 | - ip4_frags.rnd); |
2674 | -} |
2675 | - |
2676 | -static unsigned int ip4_hashfn(const struct inet_frag_queue *q) |
2677 | -{ |
2678 | - const struct ipq *ipq; |
2679 | - |
2680 | - ipq = container_of(q, struct ipq, q); |
2681 | - return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol); |
2682 | -} |
2683 | - |
2684 | -static bool ip4_frag_match(const struct inet_frag_queue *q, const void *a) |
2685 | -{ |
2686 | - const struct ipq *qp; |
2687 | - const struct ip4_create_arg *arg = a; |
2688 | - |
2689 | - qp = container_of(q, struct ipq, q); |
2690 | - return qp->id == arg->iph->id && |
2691 | - qp->saddr == arg->iph->saddr && |
2692 | - qp->daddr == arg->iph->daddr && |
2693 | - qp->protocol == arg->iph->protocol && |
2694 | - qp->user == arg->user && |
2695 | - qp->vif == arg->vif; |
2696 | -} |
2697 | |
2698 | static void ip4_frag_init(struct inet_frag_queue *q, const void *a) |
2699 | { |
2700 | @@ -139,17 +136,12 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a) |
2701 | frags); |
2702 | struct net *net = container_of(ipv4, struct net, ipv4); |
2703 | |
2704 | - const struct ip4_create_arg *arg = a; |
2705 | + const struct frag_v4_compare_key *key = a; |
2706 | |
2707 | - qp->protocol = arg->iph->protocol; |
2708 | - qp->id = arg->iph->id; |
2709 | - qp->ecn = ip4_frag_ecn(arg->iph->tos); |
2710 | - qp->saddr = arg->iph->saddr; |
2711 | - qp->daddr = arg->iph->daddr; |
2712 | - qp->vif = arg->vif; |
2713 | - qp->user = arg->user; |
2714 | + q->key.v4 = *key; |
2715 | + qp->ecn = 0; |
2716 | qp->peer = q->net->max_dist ? |
2717 | - inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, arg->vif, 1) : |
2718 | + inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) : |
2719 | NULL; |
2720 | } |
2721 | |
2722 | @@ -167,7 +159,7 @@ static void ip4_frag_free(struct inet_frag_queue *q) |
2723 | |
2724 | static void ipq_put(struct ipq *ipq) |
2725 | { |
2726 | - inet_frag_put(&ipq->q, &ip4_frags); |
2727 | + inet_frag_put(&ipq->q); |
2728 | } |
2729 | |
2730 | /* Kill ipq entry. It is not destroyed immediately, |
2731 | @@ -175,7 +167,7 @@ static void ipq_put(struct ipq *ipq) |
2732 | */ |
2733 | static void ipq_kill(struct ipq *ipq) |
2734 | { |
2735 | - inet_frag_kill(&ipq->q, &ip4_frags); |
2736 | + inet_frag_kill(&ipq->q); |
2737 | } |
2738 | |
2739 | static bool frag_expire_skip_icmp(u32 user) |
2740 | @@ -192,8 +184,11 @@ static bool frag_expire_skip_icmp(u32 user) |
2741 | */ |
2742 | static void ip_expire(unsigned long arg) |
2743 | { |
2744 | - struct ipq *qp; |
2745 | + const struct iphdr *iph; |
2746 | + struct sk_buff *head = NULL; |
2747 | struct net *net; |
2748 | + struct ipq *qp; |
2749 | + int err; |
2750 | |
2751 | qp = container_of((struct inet_frag_queue *) arg, struct ipq, q); |
2752 | net = container_of(qp->q.net, struct net, ipv4.frags); |
2753 | @@ -206,51 +201,65 @@ static void ip_expire(unsigned long arg) |
2754 | |
2755 | ipq_kill(qp); |
2756 | __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); |
2757 | + __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); |
2758 | |
2759 | - if (!inet_frag_evicting(&qp->q)) { |
2760 | - struct sk_buff *clone, *head = qp->q.fragments; |
2761 | - const struct iphdr *iph; |
2762 | - int err; |
2763 | - |
2764 | - __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); |
2765 | + if (!(qp->q.flags & INET_FRAG_FIRST_IN)) |
2766 | + goto out; |
2767 | |
2768 | - if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) |
2769 | + /* sk_buff::dev and sk_buff::rbnode are unionized. So we |
2770 | + * pull the head out of the tree in order to be able to |
2771 | + * deal with head->dev. |
2772 | + */ |
2773 | + if (qp->q.fragments) { |
2774 | + head = qp->q.fragments; |
2775 | + qp->q.fragments = head->next; |
2776 | + } else { |
2777 | + head = skb_rb_first(&qp->q.rb_fragments); |
2778 | + if (!head) |
2779 | goto out; |
2780 | + if (FRAG_CB(head)->next_frag) |
2781 | + rb_replace_node(&head->rbnode, |
2782 | + &FRAG_CB(head)->next_frag->rbnode, |
2783 | + &qp->q.rb_fragments); |
2784 | + else |
2785 | + rb_erase(&head->rbnode, &qp->q.rb_fragments); |
2786 | + memset(&head->rbnode, 0, sizeof(head->rbnode)); |
2787 | + barrier(); |
2788 | + } |
2789 | + if (head == qp->q.fragments_tail) |
2790 | + qp->q.fragments_tail = NULL; |
2791 | |
2792 | - head->dev = dev_get_by_index_rcu(net, qp->iif); |
2793 | - if (!head->dev) |
2794 | - goto out; |
2795 | + sub_frag_mem_limit(qp->q.net, head->truesize); |
2796 | + |
2797 | + head->dev = dev_get_by_index_rcu(net, qp->iif); |
2798 | + if (!head->dev) |
2799 | + goto out; |
2800 | |
2801 | |
2802 | - /* skb has no dst, perform route lookup again */ |
2803 | - iph = ip_hdr(head); |
2804 | - err = ip_route_input_noref(head, iph->daddr, iph->saddr, |
2805 | + /* skb has no dst, perform route lookup again */ |
2806 | + iph = ip_hdr(head); |
2807 | + err = ip_route_input_noref(head, iph->daddr, iph->saddr, |
2808 | iph->tos, head->dev); |
2809 | - if (err) |
2810 | - goto out; |
2811 | + if (err) |
2812 | + goto out; |
2813 | |
2814 | - /* Only an end host needs to send an ICMP |
2815 | - * "Fragment Reassembly Timeout" message, per RFC792. |
2816 | - */ |
2817 | - if (frag_expire_skip_icmp(qp->user) && |
2818 | - (skb_rtable(head)->rt_type != RTN_LOCAL)) |
2819 | - goto out; |
2820 | + /* Only an end host needs to send an ICMP |
2821 | + * "Fragment Reassembly Timeout" message, per RFC792. |
2822 | + */ |
2823 | + if (frag_expire_skip_icmp(qp->q.key.v4.user) && |
2824 | + (skb_rtable(head)->rt_type != RTN_LOCAL)) |
2825 | + goto out; |
2826 | |
2827 | - clone = skb_clone(head, GFP_ATOMIC); |
2828 | + spin_unlock(&qp->q.lock); |
2829 | + icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); |
2830 | + goto out_rcu_unlock; |
2831 | |
2832 | - /* Send an ICMP "Fragment Reassembly Timeout" message. */ |
2833 | - if (clone) { |
2834 | - spin_unlock(&qp->q.lock); |
2835 | - icmp_send(clone, ICMP_TIME_EXCEEDED, |
2836 | - ICMP_EXC_FRAGTIME, 0); |
2837 | - consume_skb(clone); |
2838 | - goto out_rcu_unlock; |
2839 | - } |
2840 | - } |
2841 | out: |
2842 | spin_unlock(&qp->q.lock); |
2843 | out_rcu_unlock: |
2844 | rcu_read_unlock(); |
2845 | + if (head) |
2846 | + kfree_skb(head); |
2847 | ipq_put(qp); |
2848 | } |
2849 | |
2850 | @@ -260,21 +269,20 @@ out_rcu_unlock: |
2851 | static struct ipq *ip_find(struct net *net, struct iphdr *iph, |
2852 | u32 user, int vif) |
2853 | { |
2854 | + struct frag_v4_compare_key key = { |
2855 | + .saddr = iph->saddr, |
2856 | + .daddr = iph->daddr, |
2857 | + .user = user, |
2858 | + .vif = vif, |
2859 | + .id = iph->id, |
2860 | + .protocol = iph->protocol, |
2861 | + }; |
2862 | struct inet_frag_queue *q; |
2863 | - struct ip4_create_arg arg; |
2864 | - unsigned int hash; |
2865 | - |
2866 | - arg.iph = iph; |
2867 | - arg.user = user; |
2868 | - arg.vif = vif; |
2869 | |
2870 | - hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol); |
2871 | - |
2872 | - q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash); |
2873 | - if (IS_ERR_OR_NULL(q)) { |
2874 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
2875 | + q = inet_frag_find(&net->ipv4.frags, &key); |
2876 | + if (!q) |
2877 | return NULL; |
2878 | - } |
2879 | + |
2880 | return container_of(q, struct ipq, q); |
2881 | } |
2882 | |
2883 | @@ -294,7 +302,7 @@ static int ip_frag_too_far(struct ipq *qp) |
2884 | end = atomic_inc_return(&peer->rid); |
2885 | qp->rid = end; |
2886 | |
2887 | - rc = qp->q.fragments && (end - start) > max; |
2888 | + rc = qp->q.fragments_tail && (end - start) > max; |
2889 | |
2890 | if (rc) { |
2891 | struct net *net; |
2892 | @@ -308,7 +316,6 @@ static int ip_frag_too_far(struct ipq *qp) |
2893 | |
2894 | static int ip_frag_reinit(struct ipq *qp) |
2895 | { |
2896 | - struct sk_buff *fp; |
2897 | unsigned int sum_truesize = 0; |
2898 | |
2899 | if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) { |
2900 | @@ -316,21 +323,16 @@ static int ip_frag_reinit(struct ipq *qp) |
2901 | return -ETIMEDOUT; |
2902 | } |
2903 | |
2904 | - fp = qp->q.fragments; |
2905 | - do { |
2906 | - struct sk_buff *xp = fp->next; |
2907 | - |
2908 | - sum_truesize += fp->truesize; |
2909 | - kfree_skb(fp); |
2910 | - fp = xp; |
2911 | - } while (fp); |
2912 | + sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments); |
2913 | sub_frag_mem_limit(qp->q.net, sum_truesize); |
2914 | |
2915 | qp->q.flags = 0; |
2916 | qp->q.len = 0; |
2917 | qp->q.meat = 0; |
2918 | qp->q.fragments = NULL; |
2919 | + qp->q.rb_fragments = RB_ROOT; |
2920 | qp->q.fragments_tail = NULL; |
2921 | + qp->q.last_run_head = NULL; |
2922 | qp->iif = 0; |
2923 | qp->ecn = 0; |
2924 | |
2925 | @@ -340,7 +342,9 @@ static int ip_frag_reinit(struct ipq *qp) |
2926 | /* Add new segment to existing queue. */ |
2927 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
2928 | { |
2929 | - struct sk_buff *prev, *next; |
2930 | + struct net *net = container_of(qp->q.net, struct net, ipv4.frags); |
2931 | + struct rb_node **rbn, *parent; |
2932 | + struct sk_buff *skb1, *prev_tail; |
2933 | struct net_device *dev; |
2934 | unsigned int fragsize; |
2935 | int flags, offset; |
2936 | @@ -403,99 +407,61 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) |
2937 | if (err) |
2938 | goto err; |
2939 | |
2940 | - /* Find out which fragments are in front and at the back of us |
2941 | - * in the chain of fragments so far. We must know where to put |
2942 | - * this fragment, right? |
2943 | - */ |
2944 | - prev = qp->q.fragments_tail; |
2945 | - if (!prev || FRAG_CB(prev)->offset < offset) { |
2946 | - next = NULL; |
2947 | - goto found; |
2948 | - } |
2949 | - prev = NULL; |
2950 | - for (next = qp->q.fragments; next != NULL; next = next->next) { |
2951 | - if (FRAG_CB(next)->offset >= offset) |
2952 | - break; /* bingo! */ |
2953 | - prev = next; |
2954 | - } |
2955 | - |
2956 | -found: |
2957 | - /* We found where to put this one. Check for overlap with |
2958 | - * preceding fragment, and, if needed, align things so that |
2959 | - * any overlaps are eliminated. |
2960 | + /* Note : skb->rbnode and skb->dev share the same location. */ |
2961 | + dev = skb->dev; |
2962 | + /* Makes sure compiler wont do silly aliasing games */ |
2963 | + barrier(); |
2964 | + |
2965 | + /* RFC5722, Section 4, amended by Errata ID : 3089 |
2966 | + * When reassembling an IPv6 datagram, if |
2967 | + * one or more its constituent fragments is determined to be an |
2968 | + * overlapping fragment, the entire datagram (and any constituent |
2969 | + * fragments) MUST be silently discarded. |
2970 | + * |
2971 | + * We do the same here for IPv4 (and increment an snmp counter). |
2972 | */ |
2973 | - if (prev) { |
2974 | - int i = (FRAG_CB(prev)->offset + prev->len) - offset; |
2975 | |
2976 | - if (i > 0) { |
2977 | - offset += i; |
2978 | - err = -EINVAL; |
2979 | - if (end <= offset) |
2980 | - goto err; |
2981 | - err = -ENOMEM; |
2982 | - if (!pskb_pull(skb, i)) |
2983 | - goto err; |
2984 | - if (skb->ip_summed != CHECKSUM_UNNECESSARY) |
2985 | - skb->ip_summed = CHECKSUM_NONE; |
2986 | - } |
2987 | - } |
2988 | - |
2989 | - err = -ENOMEM; |
2990 | - |
2991 | - while (next && FRAG_CB(next)->offset < end) { |
2992 | - int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ |
2993 | - |
2994 | - if (i < next->len) { |
2995 | - int delta = -next->truesize; |
2996 | - |
2997 | - /* Eat head of the next overlapped fragment |
2998 | - * and leave the loop. The next ones cannot overlap. |
2999 | - */ |
3000 | - if (!pskb_pull(next, i)) |
3001 | - goto err; |
3002 | - delta += next->truesize; |
3003 | - if (delta) |
3004 | - add_frag_mem_limit(qp->q.net, delta); |
3005 | - FRAG_CB(next)->offset += i; |
3006 | - qp->q.meat -= i; |
3007 | - if (next->ip_summed != CHECKSUM_UNNECESSARY) |
3008 | - next->ip_summed = CHECKSUM_NONE; |
3009 | - break; |
3010 | - } else { |
3011 | - struct sk_buff *free_it = next; |
3012 | - |
3013 | - /* Old fragment is completely overridden with |
3014 | - * new one drop it. |
3015 | - */ |
3016 | - next = next->next; |
3017 | - |
3018 | - if (prev) |
3019 | - prev->next = next; |
3020 | - else |
3021 | - qp->q.fragments = next; |
3022 | - |
3023 | - qp->q.meat -= free_it->len; |
3024 | - sub_frag_mem_limit(qp->q.net, free_it->truesize); |
3025 | - kfree_skb(free_it); |
3026 | - } |
3027 | + /* Find out where to put this fragment. */ |
3028 | + prev_tail = qp->q.fragments_tail; |
3029 | + if (!prev_tail) |
3030 | + ip4_frag_create_run(&qp->q, skb); /* First fragment. */ |
3031 | + else if (prev_tail->ip_defrag_offset + prev_tail->len < end) { |
3032 | + /* This is the common case: skb goes to the end. */ |
3033 | + /* Detect and discard overlaps. */ |
3034 | + if (offset < prev_tail->ip_defrag_offset + prev_tail->len) |
3035 | + goto discard_qp; |
3036 | + if (offset == prev_tail->ip_defrag_offset + prev_tail->len) |
3037 | + ip4_frag_append_to_last_run(&qp->q, skb); |
3038 | + else |
3039 | + ip4_frag_create_run(&qp->q, skb); |
3040 | + } else { |
3041 | + /* Binary search. Note that skb can become the first fragment, |
3042 | + * but not the last (covered above). |
3043 | + */ |
3044 | + rbn = &qp->q.rb_fragments.rb_node; |
3045 | + do { |
3046 | + parent = *rbn; |
3047 | + skb1 = rb_to_skb(parent); |
3048 | + if (end <= skb1->ip_defrag_offset) |
3049 | + rbn = &parent->rb_left; |
3050 | + else if (offset >= skb1->ip_defrag_offset + |
3051 | + FRAG_CB(skb1)->frag_run_len) |
3052 | + rbn = &parent->rb_right; |
3053 | + else /* Found an overlap with skb1. */ |
3054 | + goto discard_qp; |
3055 | + } while (*rbn); |
3056 | + /* Here we have parent properly set, and rbn pointing to |
3057 | + * one of its NULL left/right children. Insert skb. |
3058 | + */ |
3059 | + ip4_frag_init_run(skb); |
3060 | + rb_link_node(&skb->rbnode, parent, rbn); |
3061 | + rb_insert_color(&skb->rbnode, &qp->q.rb_fragments); |
3062 | } |
3063 | |
3064 | - FRAG_CB(skb)->offset = offset; |
3065 | - |
3066 | - /* Insert this fragment in the chain of fragments. */ |
3067 | - skb->next = next; |
3068 | - if (!next) |
3069 | - qp->q.fragments_tail = skb; |
3070 | - if (prev) |
3071 | - prev->next = skb; |
3072 | - else |
3073 | - qp->q.fragments = skb; |
3074 | - |
3075 | - dev = skb->dev; |
3076 | - if (dev) { |
3077 | + if (dev) |
3078 | qp->iif = dev->ifindex; |
3079 | - skb->dev = NULL; |
3080 | - } |
3081 | + skb->ip_defrag_offset = offset; |
3082 | + |
3083 | qp->q.stamp = skb->tstamp; |
3084 | qp->q.meat += skb->len; |
3085 | qp->ecn |= ecn; |
3086 | @@ -517,7 +483,7 @@ found: |
3087 | unsigned long orefdst = skb->_skb_refdst; |
3088 | |
3089 | skb->_skb_refdst = 0UL; |
3090 | - err = ip_frag_reasm(qp, prev, dev); |
3091 | + err = ip_frag_reasm(qp, skb, prev_tail, dev); |
3092 | skb->_skb_refdst = orefdst; |
3093 | return err; |
3094 | } |
3095 | @@ -525,20 +491,24 @@ found: |
3096 | skb_dst_drop(skb); |
3097 | return -EINPROGRESS; |
3098 | |
3099 | +discard_qp: |
3100 | + inet_frag_kill(&qp->q); |
3101 | + err = -EINVAL; |
3102 | + __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS); |
3103 | err: |
3104 | kfree_skb(skb); |
3105 | return err; |
3106 | } |
3107 | |
3108 | - |
3109 | /* Build a new IP datagram from all its fragments. */ |
3110 | - |
3111 | -static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
3112 | - struct net_device *dev) |
3113 | +static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, |
3114 | + struct sk_buff *prev_tail, struct net_device *dev) |
3115 | { |
3116 | struct net *net = container_of(qp->q.net, struct net, ipv4.frags); |
3117 | struct iphdr *iph; |
3118 | - struct sk_buff *fp, *head = qp->q.fragments; |
3119 | + struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments); |
3120 | + struct sk_buff **nextp; /* To build frag_list. */ |
3121 | + struct rb_node *rbn; |
3122 | int len; |
3123 | int ihlen; |
3124 | int err; |
3125 | @@ -552,26 +522,27 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
3126 | goto out_fail; |
3127 | } |
3128 | /* Make the one we just received the head. */ |
3129 | - if (prev) { |
3130 | - head = prev->next; |
3131 | - fp = skb_clone(head, GFP_ATOMIC); |
3132 | + if (head != skb) { |
3133 | + fp = skb_clone(skb, GFP_ATOMIC); |
3134 | if (!fp) |
3135 | goto out_nomem; |
3136 | - |
3137 | - fp->next = head->next; |
3138 | - if (!fp->next) |
3139 | + FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag; |
3140 | + if (RB_EMPTY_NODE(&skb->rbnode)) |
3141 | + FRAG_CB(prev_tail)->next_frag = fp; |
3142 | + else |
3143 | + rb_replace_node(&skb->rbnode, &fp->rbnode, |
3144 | + &qp->q.rb_fragments); |
3145 | + if (qp->q.fragments_tail == skb) |
3146 | qp->q.fragments_tail = fp; |
3147 | - prev->next = fp; |
3148 | - |
3149 | - skb_morph(head, qp->q.fragments); |
3150 | - head->next = qp->q.fragments->next; |
3151 | - |
3152 | - consume_skb(qp->q.fragments); |
3153 | - qp->q.fragments = head; |
3154 | + skb_morph(skb, head); |
3155 | + FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag; |
3156 | + rb_replace_node(&head->rbnode, &skb->rbnode, |
3157 | + &qp->q.rb_fragments); |
3158 | + consume_skb(head); |
3159 | + head = skb; |
3160 | } |
3161 | |
3162 | - WARN_ON(!head); |
3163 | - WARN_ON(FRAG_CB(head)->offset != 0); |
3164 | + WARN_ON(head->ip_defrag_offset != 0); |
3165 | |
3166 | /* Allocate a new buffer for the datagram. */ |
3167 | ihlen = ip_hdrlen(head); |
3168 | @@ -595,35 +566,61 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
3169 | clone = alloc_skb(0, GFP_ATOMIC); |
3170 | if (!clone) |
3171 | goto out_nomem; |
3172 | - clone->next = head->next; |
3173 | - head->next = clone; |
3174 | skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; |
3175 | skb_frag_list_init(head); |
3176 | for (i = 0; i < skb_shinfo(head)->nr_frags; i++) |
3177 | plen += skb_frag_size(&skb_shinfo(head)->frags[i]); |
3178 | clone->len = clone->data_len = head->data_len - plen; |
3179 | - head->data_len -= clone->len; |
3180 | - head->len -= clone->len; |
3181 | + head->truesize += clone->truesize; |
3182 | clone->csum = 0; |
3183 | clone->ip_summed = head->ip_summed; |
3184 | add_frag_mem_limit(qp->q.net, clone->truesize); |
3185 | + skb_shinfo(head)->frag_list = clone; |
3186 | + nextp = &clone->next; |
3187 | + } else { |
3188 | + nextp = &skb_shinfo(head)->frag_list; |
3189 | } |
3190 | |
3191 | - skb_shinfo(head)->frag_list = head->next; |
3192 | skb_push(head, head->data - skb_network_header(head)); |
3193 | |
3194 | - for (fp=head->next; fp; fp = fp->next) { |
3195 | - head->data_len += fp->len; |
3196 | - head->len += fp->len; |
3197 | - if (head->ip_summed != fp->ip_summed) |
3198 | - head->ip_summed = CHECKSUM_NONE; |
3199 | - else if (head->ip_summed == CHECKSUM_COMPLETE) |
3200 | - head->csum = csum_add(head->csum, fp->csum); |
3201 | - head->truesize += fp->truesize; |
3202 | + /* Traverse the tree in order, to build frag_list. */ |
3203 | + fp = FRAG_CB(head)->next_frag; |
3204 | + rbn = rb_next(&head->rbnode); |
3205 | + rb_erase(&head->rbnode, &qp->q.rb_fragments); |
3206 | + while (rbn || fp) { |
3207 | + /* fp points to the next sk_buff in the current run; |
3208 | + * rbn points to the next run. |
3209 | + */ |
3210 | + /* Go through the current run. */ |
3211 | + while (fp) { |
3212 | + *nextp = fp; |
3213 | + nextp = &fp->next; |
3214 | + fp->prev = NULL; |
3215 | + memset(&fp->rbnode, 0, sizeof(fp->rbnode)); |
3216 | + fp->sk = NULL; |
3217 | + head->data_len += fp->len; |
3218 | + head->len += fp->len; |
3219 | + if (head->ip_summed != fp->ip_summed) |
3220 | + head->ip_summed = CHECKSUM_NONE; |
3221 | + else if (head->ip_summed == CHECKSUM_COMPLETE) |
3222 | + head->csum = csum_add(head->csum, fp->csum); |
3223 | + head->truesize += fp->truesize; |
3224 | + fp = FRAG_CB(fp)->next_frag; |
3225 | + } |
3226 | + /* Move to the next run. */ |
3227 | + if (rbn) { |
3228 | + struct rb_node *rbnext = rb_next(rbn); |
3229 | + |
3230 | + fp = rb_to_skb(rbn); |
3231 | + rb_erase(rbn, &qp->q.rb_fragments); |
3232 | + rbn = rbnext; |
3233 | + } |
3234 | } |
3235 | sub_frag_mem_limit(qp->q.net, head->truesize); |
3236 | |
3237 | + *nextp = NULL; |
3238 | head->next = NULL; |
3239 | + head->prev = NULL; |
3240 | head->dev = dev; |
3241 | head->tstamp = qp->q.stamp; |
3242 | IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size); |
3243 | @@ -651,7 +648,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, |
3244 | |
3245 | __IP_INC_STATS(net, IPSTATS_MIB_REASMOKS); |
3246 | qp->q.fragments = NULL; |
3247 | + qp->q.rb_fragments = RB_ROOT; |
3248 | qp->q.fragments_tail = NULL; |
3249 | + qp->q.last_run_head = NULL; |
3250 | return 0; |
3251 | |
3252 | out_nomem: |
3253 | @@ -659,7 +658,7 @@ out_nomem: |
3254 | err = -ENOMEM; |
3255 | goto out_fail; |
3256 | out_oversize: |
3257 | - net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->saddr); |
3258 | + net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr); |
3259 | out_fail: |
3260 | __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); |
3261 | return err; |
3262 | @@ -733,25 +732,46 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) |
3263 | } |
3264 | EXPORT_SYMBOL(ip_check_defrag); |
3265 | |
3266 | +unsigned int inet_frag_rbtree_purge(struct rb_root *root) |
3267 | +{ |
3268 | + struct rb_node *p = rb_first(root); |
3269 | + unsigned int sum = 0; |
3270 | + |
3271 | + while (p) { |
3272 | + struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); |
3273 | + |
3274 | + p = rb_next(p); |
3275 | + rb_erase(&skb->rbnode, root); |
3276 | + while (skb) { |
3277 | + struct sk_buff *next = FRAG_CB(skb)->next_frag; |
3278 | + |
3279 | + sum += skb->truesize; |
3280 | + kfree_skb(skb); |
3281 | + skb = next; |
3282 | + } |
3283 | + } |
3284 | + return sum; |
3285 | +} |
3286 | +EXPORT_SYMBOL(inet_frag_rbtree_purge); |
3287 | + |
3288 | #ifdef CONFIG_SYSCTL |
3289 | -static int zero; |
3290 | +static int dist_min; |
3291 | |
3292 | static struct ctl_table ip4_frags_ns_ctl_table[] = { |
3293 | { |
3294 | .procname = "ipfrag_high_thresh", |
3295 | .data = &init_net.ipv4.frags.high_thresh, |
3296 | - .maxlen = sizeof(int), |
3297 | + .maxlen = sizeof(unsigned long), |
3298 | .mode = 0644, |
3299 | - .proc_handler = proc_dointvec_minmax, |
3300 | + .proc_handler = proc_doulongvec_minmax, |
3301 | .extra1 = &init_net.ipv4.frags.low_thresh |
3302 | }, |
3303 | { |
3304 | .procname = "ipfrag_low_thresh", |
3305 | .data = &init_net.ipv4.frags.low_thresh, |
3306 | - .maxlen = sizeof(int), |
3307 | + .maxlen = sizeof(unsigned long), |
3308 | .mode = 0644, |
3309 | - .proc_handler = proc_dointvec_minmax, |
3310 | - .extra1 = &zero, |
3311 | + .proc_handler = proc_doulongvec_minmax, |
3312 | .extra2 = &init_net.ipv4.frags.high_thresh |
3313 | }, |
3314 | { |
3315 | @@ -767,7 +787,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = { |
3316 | .maxlen = sizeof(int), |
3317 | .mode = 0644, |
3318 | .proc_handler = proc_dointvec_minmax, |
3319 | - .extra1 = &zero |
3320 | + .extra1 = &dist_min, |
3321 | }, |
3322 | { } |
3323 | }; |
3324 | @@ -849,6 +869,8 @@ static void __init ip4_frags_ctl_register(void) |
3325 | |
3326 | static int __net_init ipv4_frags_init_net(struct net *net) |
3327 | { |
3328 | + int res; |
3329 | + |
3330 | /* Fragment cache limits. |
3331 | * |
3332 | * The fragment memory accounting code, (tries to) account for |
3333 | @@ -873,16 +895,21 @@ static int __net_init ipv4_frags_init_net(struct net *net) |
3334 | net->ipv4.frags.timeout = IP_FRAG_TIME; |
3335 | |
3336 | net->ipv4.frags.max_dist = 64; |
3337 | - |
3338 | - inet_frags_init_net(&net->ipv4.frags); |
3339 | - |
3340 | - return ip4_frags_ns_ctl_register(net); |
3341 | + net->ipv4.frags.f = &ip4_frags; |
3342 | + |
3343 | + res = inet_frags_init_net(&net->ipv4.frags); |
3344 | + if (res < 0) |
3345 | + return res; |
3346 | + res = ip4_frags_ns_ctl_register(net); |
3347 | + if (res < 0) |
3348 | + inet_frags_exit_net(&net->ipv4.frags); |
3349 | + return res; |
3350 | } |
3351 | |
3352 | static void __net_exit ipv4_frags_exit_net(struct net *net) |
3353 | { |
3354 | ip4_frags_ns_ctl_unregister(net); |
3355 | - inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); |
3356 | + inet_frags_exit_net(&net->ipv4.frags); |
3357 | } |
3358 | |
3359 | static struct pernet_operations ip4_frags_ops = { |
3360 | @@ -890,17 +917,49 @@ static struct pernet_operations ip4_frags_ops = { |
3361 | .exit = ipv4_frags_exit_net, |
3362 | }; |
3363 | |
3364 | + |
3365 | +static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed) |
3366 | +{ |
3367 | + return jhash2(data, |
3368 | + sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); |
3369 | +} |
3370 | + |
3371 | +static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed) |
3372 | +{ |
3373 | + const struct inet_frag_queue *fq = data; |
3374 | + |
3375 | + return jhash2((const u32 *)&fq->key.v4, |
3376 | + sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); |
3377 | +} |
3378 | + |
3379 | +static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) |
3380 | +{ |
3381 | + const struct frag_v4_compare_key *key = arg->key; |
3382 | + const struct inet_frag_queue *fq = ptr; |
3383 | + |
3384 | + return !!memcmp(&fq->key, key, sizeof(*key)); |
3385 | +} |
3386 | + |
3387 | +static const struct rhashtable_params ip4_rhash_params = { |
3388 | + .head_offset = offsetof(struct inet_frag_queue, node), |
3389 | + .key_offset = offsetof(struct inet_frag_queue, key), |
3390 | + .key_len = sizeof(struct frag_v4_compare_key), |
3391 | + .hashfn = ip4_key_hashfn, |
3392 | + .obj_hashfn = ip4_obj_hashfn, |
3393 | + .obj_cmpfn = ip4_obj_cmpfn, |
3394 | + .automatic_shrinking = true, |
3395 | +}; |
3396 | + |
3397 | void __init ipfrag_init(void) |
3398 | { |
3399 | - ip4_frags_ctl_register(); |
3400 | - register_pernet_subsys(&ip4_frags_ops); |
3401 | - ip4_frags.hashfn = ip4_hashfn; |
3402 | ip4_frags.constructor = ip4_frag_init; |
3403 | ip4_frags.destructor = ip4_frag_free; |
3404 | ip4_frags.qsize = sizeof(struct ipq); |
3405 | - ip4_frags.match = ip4_frag_match; |
3406 | ip4_frags.frag_expire = ip_expire; |
3407 | ip4_frags.frags_cache_name = ip_frag_cache_name; |
3408 | + ip4_frags.rhash_params = ip4_rhash_params; |
3409 | if (inet_frags_init(&ip4_frags)) |
3410 | panic("IP: failed to allocate ip4_frags cache\n"); |
3411 | + ip4_frags_ctl_register(); |
3412 | + register_pernet_subsys(&ip4_frags_ops); |
3413 | } |
3414 | diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c |
3415 | index b21e435f428c..a5851c0bc278 100644 |
3416 | --- a/net/ipv4/ip_sockglue.c |
3417 | +++ b/net/ipv4/ip_sockglue.c |
3418 | @@ -134,7 +134,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) |
3419 | static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) |
3420 | { |
3421 | struct sockaddr_in sin; |
3422 | - const struct iphdr *iph = ip_hdr(skb); |
3423 | __be16 *ports; |
3424 | int end; |
3425 | |
3426 | @@ -149,7 +148,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) |
3427 | ports = (__be16 *)skb_transport_header(skb); |
3428 | |
3429 | sin.sin_family = AF_INET; |
3430 | - sin.sin_addr.s_addr = iph->daddr; |
3431 | + sin.sin_addr.s_addr = ip_hdr(skb)->daddr; |
3432 | sin.sin_port = ports[1]; |
3433 | memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); |
3434 | |
3435 | diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c |
3436 | index e1271e75e107..d8d99c21a9c1 100644 |
3437 | --- a/net/ipv4/ip_tunnel.c |
3438 | +++ b/net/ipv4/ip_tunnel.c |
3439 | @@ -627,6 +627,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, |
3440 | const struct iphdr *tnl_params, u8 protocol) |
3441 | { |
3442 | struct ip_tunnel *tunnel = netdev_priv(dev); |
3443 | + unsigned int inner_nhdr_len = 0; |
3444 | const struct iphdr *inner_iph; |
3445 | struct flowi4 fl4; |
3446 | u8 tos, ttl; |
3447 | @@ -636,6 +637,14 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, |
3448 | __be32 dst; |
3449 | bool connected; |
3450 | |
3451 | + /* ensure we can access the inner net header, for several users below */ |
3452 | + if (skb->protocol == htons(ETH_P_IP)) |
3453 | + inner_nhdr_len = sizeof(struct iphdr); |
3454 | + else if (skb->protocol == htons(ETH_P_IPV6)) |
3455 | + inner_nhdr_len = sizeof(struct ipv6hdr); |
3456 | + if (unlikely(!pskb_may_pull(skb, inner_nhdr_len))) |
3457 | + goto tx_error; |
3458 | + |
3459 | inner_iph = (const struct iphdr *)skb_inner_network_header(skb); |
3460 | connected = (tunnel->parms.iph.daddr != 0); |
3461 | |
3462 | diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c |
3463 | index 7143ca1a6af9..ec48d8eafc7e 100644 |
3464 | --- a/net/ipv4/proc.c |
3465 | +++ b/net/ipv4/proc.c |
3466 | @@ -54,7 +54,6 @@ |
3467 | static int sockstat_seq_show(struct seq_file *seq, void *v) |
3468 | { |
3469 | struct net *net = seq->private; |
3470 | - unsigned int frag_mem; |
3471 | int orphans, sockets; |
3472 | |
3473 | local_bh_disable(); |
3474 | @@ -74,8 +73,9 @@ static int sockstat_seq_show(struct seq_file *seq, void *v) |
3475 | sock_prot_inuse_get(net, &udplite_prot)); |
3476 | seq_printf(seq, "RAW: inuse %d\n", |
3477 | sock_prot_inuse_get(net, &raw_prot)); |
3478 | - frag_mem = ip_frag_mem(net); |
3479 | - seq_printf(seq, "FRAG: inuse %u memory %u\n", !!frag_mem, frag_mem); |
3480 | + seq_printf(seq, "FRAG: inuse %u memory %lu\n", |
3481 | + atomic_read(&net->ipv4.frags.rhashtable.nelems), |
3482 | + frag_mem_limit(&net->ipv4.frags)); |
3483 | return 0; |
3484 | } |
3485 | |
3486 | @@ -134,6 +134,7 @@ static const struct snmp_mib snmp4_ipextstats_list[] = { |
3487 | SNMP_MIB_ITEM("InECT1Pkts", IPSTATS_MIB_ECT1PKTS), |
3488 | SNMP_MIB_ITEM("InECT0Pkts", IPSTATS_MIB_ECT0PKTS), |
3489 | SNMP_MIB_ITEM("InCEPkts", IPSTATS_MIB_CEPKTS), |
3490 | + SNMP_MIB_ITEM("ReasmOverlaps", IPSTATS_MIB_REASM_OVERLAPS), |
3491 | SNMP_MIB_SENTINEL |
3492 | }; |
3493 | |
3494 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
3495 | index 9d0b73aa649f..dbb153c6b21a 100644 |
3496 | --- a/net/ipv4/tcp_input.c |
3497 | +++ b/net/ipv4/tcp_input.c |
3498 | @@ -4406,7 +4406,7 @@ static void tcp_ofo_queue(struct sock *sk) |
3499 | |
3500 | p = rb_first(&tp->out_of_order_queue); |
3501 | while (p) { |
3502 | - skb = rb_entry(p, struct sk_buff, rbnode); |
3503 | + skb = rb_to_skb(p); |
3504 | if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) |
3505 | break; |
3506 | |
3507 | @@ -4470,7 +4470,7 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb, |
3508 | static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) |
3509 | { |
3510 | struct tcp_sock *tp = tcp_sk(sk); |
3511 | - struct rb_node **p, *q, *parent; |
3512 | + struct rb_node **p, *parent; |
3513 | struct sk_buff *skb1; |
3514 | u32 seq, end_seq; |
3515 | bool fragstolen; |
3516 | @@ -4529,7 +4529,7 @@ coalesce_done: |
3517 | parent = NULL; |
3518 | while (*p) { |
3519 | parent = *p; |
3520 | - skb1 = rb_entry(parent, struct sk_buff, rbnode); |
3521 | + skb1 = rb_to_skb(parent); |
3522 | if (before(seq, TCP_SKB_CB(skb1)->seq)) { |
3523 | p = &parent->rb_left; |
3524 | continue; |
3525 | @@ -4574,9 +4574,7 @@ insert: |
3526 | |
3527 | merge_right: |
3528 | /* Remove other segments covered by skb. */ |
3529 | - while ((q = rb_next(&skb->rbnode)) != NULL) { |
3530 | - skb1 = rb_entry(q, struct sk_buff, rbnode); |
3531 | - |
3532 | + while ((skb1 = skb_rb_next(skb)) != NULL) { |
3533 | if (!after(end_seq, TCP_SKB_CB(skb1)->seq)) |
3534 | break; |
3535 | if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) { |
3536 | @@ -4591,7 +4589,7 @@ merge_right: |
3537 | tcp_drop(sk, skb1); |
3538 | } |
3539 | /* If there is no skb after us, we are the last_skb ! */ |
3540 | - if (!q) |
3541 | + if (!skb1) |
3542 | tp->ooo_last_skb = skb; |
3543 | |
3544 | add_sack: |
3545 | @@ -4792,7 +4790,7 @@ static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *li |
3546 | if (list) |
3547 | return !skb_queue_is_last(list, skb) ? skb->next : NULL; |
3548 | |
3549 | - return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode); |
3550 | + return skb_rb_next(skb); |
3551 | } |
3552 | |
3553 | static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, |
3554 | @@ -4821,7 +4819,7 @@ static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb) |
3555 | |
3556 | while (*p) { |
3557 | parent = *p; |
3558 | - skb1 = rb_entry(parent, struct sk_buff, rbnode); |
3559 | + skb1 = rb_to_skb(parent); |
3560 | if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq)) |
3561 | p = &parent->rb_left; |
3562 | else |
3563 | @@ -4941,19 +4939,12 @@ static void tcp_collapse_ofo_queue(struct sock *sk) |
3564 | struct tcp_sock *tp = tcp_sk(sk); |
3565 | u32 range_truesize, sum_tiny = 0; |
3566 | struct sk_buff *skb, *head; |
3567 | - struct rb_node *p; |
3568 | u32 start, end; |
3569 | |
3570 | - p = rb_first(&tp->out_of_order_queue); |
3571 | - skb = rb_entry_safe(p, struct sk_buff, rbnode); |
3572 | + skb = skb_rb_first(&tp->out_of_order_queue); |
3573 | new_range: |
3574 | if (!skb) { |
3575 | - p = rb_last(&tp->out_of_order_queue); |
3576 | - /* Note: This is possible p is NULL here. We do not |
3577 | - * use rb_entry_safe(), as ooo_last_skb is valid only |
3578 | - * if rbtree is not empty. |
3579 | - */ |
3580 | - tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode); |
3581 | + tp->ooo_last_skb = skb_rb_last(&tp->out_of_order_queue); |
3582 | return; |
3583 | } |
3584 | start = TCP_SKB_CB(skb)->seq; |
3585 | @@ -4961,7 +4952,7 @@ new_range: |
3586 | range_truesize = skb->truesize; |
3587 | |
3588 | for (head = skb;;) { |
3589 | - skb = tcp_skb_next(skb, NULL); |
3590 | + skb = skb_rb_next(skb); |
3591 | |
3592 | /* Range is terminated when we see a gap or when |
3593 | * we are at the queue end. |
3594 | @@ -5017,7 +5008,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk) |
3595 | prev = rb_prev(node); |
3596 | rb_erase(node, &tp->out_of_order_queue); |
3597 | goal -= rb_to_skb(node)->truesize; |
3598 | - tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode)); |
3599 | + tcp_drop(sk, rb_to_skb(node)); |
3600 | if (!prev || goal <= 0) { |
3601 | sk_mem_reclaim(sk); |
3602 | if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && |
3603 | @@ -5027,7 +5018,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk) |
3604 | } |
3605 | node = prev; |
3606 | } while (node); |
3607 | - tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode); |
3608 | + tp->ooo_last_skb = rb_to_skb(prev); |
3609 | |
3610 | /* Reset SACK state. A conforming SACK implementation will |
3611 | * do the same at a timeout based retransmit. When a connection |
3612 | @@ -5978,11 +5969,13 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) |
3613 | if (th->fin) |
3614 | goto discard; |
3615 | /* It is possible that we process SYN packets from backlog, |
3616 | - * so we need to make sure to disable BH right there. |
3617 | + * so we need to make sure to disable BH and RCU right there. |
3618 | */ |
3619 | + rcu_read_lock(); |
3620 | local_bh_disable(); |
3621 | acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0; |
3622 | local_bh_enable(); |
3623 | + rcu_read_unlock(); |
3624 | |
3625 | if (!acceptable) |
3626 | return 1; |
3627 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c |
3628 | index 16dea67792e0..1ea0c91ba994 100644 |
3629 | --- a/net/ipv4/tcp_ipv4.c |
3630 | +++ b/net/ipv4/tcp_ipv4.c |
3631 | @@ -859,9 +859,11 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst, |
3632 | if (skb) { |
3633 | __tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr); |
3634 | |
3635 | + rcu_read_lock(); |
3636 | err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr, |
3637 | ireq->ir_rmt_addr, |
3638 | - ireq_opt_deref(ireq)); |
3639 | + rcu_dereference(ireq->ireq_opt)); |
3640 | + rcu_read_unlock(); |
3641 | err = net_xmit_eval(err); |
3642 | } |
3643 | |
3644 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
3645 | index 3a27cf762da1..bc532206077f 100644 |
3646 | --- a/net/ipv6/addrconf.c |
3647 | +++ b/net/ipv6/addrconf.c |
3648 | @@ -4068,7 +4068,6 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos) |
3649 | p++; |
3650 | continue; |
3651 | } |
3652 | - state->offset++; |
3653 | return ifa; |
3654 | } |
3655 | |
3656 | @@ -4092,13 +4091,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq, |
3657 | return ifa; |
3658 | } |
3659 | |
3660 | + state->offset = 0; |
3661 | while (++state->bucket < IN6_ADDR_HSIZE) { |
3662 | - state->offset = 0; |
3663 | hlist_for_each_entry_rcu_bh(ifa, |
3664 | &inet6_addr_lst[state->bucket], addr_lst) { |
3665 | if (!net_eq(dev_net(ifa->idev->dev), net)) |
3666 | continue; |
3667 | - state->offset++; |
3668 | return ifa; |
3669 | } |
3670 | } |
3671 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c |
3672 | index cda63426eefb..fd081a14064e 100644 |
3673 | --- a/net/ipv6/ip6_tunnel.c |
3674 | +++ b/net/ipv6/ip6_tunnel.c |
3675 | @@ -1226,7 +1226,7 @@ static inline int |
3676 | ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) |
3677 | { |
3678 | struct ip6_tnl *t = netdev_priv(dev); |
3679 | - const struct iphdr *iph = ip_hdr(skb); |
3680 | + const struct iphdr *iph; |
3681 | int encap_limit = -1; |
3682 | struct flowi6 fl6; |
3683 | __u8 dsfield; |
3684 | @@ -1234,6 +1234,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) |
3685 | u8 tproto; |
3686 | int err; |
3687 | |
3688 | + /* ensure we can access the full inner ip header */ |
3689 | + if (!pskb_may_pull(skb, sizeof(struct iphdr))) |
3690 | + return -1; |
3691 | + |
3692 | + iph = ip_hdr(skb); |
3693 | memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); |
3694 | |
3695 | tproto = ACCESS_ONCE(t->parms.proto); |
3696 | @@ -1293,7 +1298,7 @@ static inline int |
3697 | ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) |
3698 | { |
3699 | struct ip6_tnl *t = netdev_priv(dev); |
3700 | - struct ipv6hdr *ipv6h = ipv6_hdr(skb); |
3701 | + struct ipv6hdr *ipv6h; |
3702 | int encap_limit = -1; |
3703 | __u16 offset; |
3704 | struct flowi6 fl6; |
3705 | @@ -1302,6 +1307,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) |
3706 | u8 tproto; |
3707 | int err; |
3708 | |
3709 | + if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) |
3710 | + return -1; |
3711 | + |
3712 | + ipv6h = ipv6_hdr(skb); |
3713 | tproto = ACCESS_ONCE(t->parms.proto); |
3714 | if ((tproto != IPPROTO_IPV6 && tproto != 0) || |
3715 | ip6_tnl_addr_conflict(t, ipv6h)) |
3716 | diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c |
3717 | index ee33a6743f3b..b9147558a8f2 100644 |
3718 | --- a/net/ipv6/netfilter/nf_conntrack_reasm.c |
3719 | +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c |
3720 | @@ -63,7 +63,6 @@ struct nf_ct_frag6_skb_cb |
3721 | static struct inet_frags nf_frags; |
3722 | |
3723 | #ifdef CONFIG_SYSCTL |
3724 | -static int zero; |
3725 | |
3726 | static struct ctl_table nf_ct_frag6_sysctl_table[] = { |
3727 | { |
3728 | @@ -76,18 +75,17 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { |
3729 | { |
3730 | .procname = "nf_conntrack_frag6_low_thresh", |
3731 | .data = &init_net.nf_frag.frags.low_thresh, |
3732 | - .maxlen = sizeof(unsigned int), |
3733 | + .maxlen = sizeof(unsigned long), |
3734 | .mode = 0644, |
3735 | - .proc_handler = proc_dointvec_minmax, |
3736 | - .extra1 = &zero, |
3737 | + .proc_handler = proc_doulongvec_minmax, |
3738 | .extra2 = &init_net.nf_frag.frags.high_thresh |
3739 | }, |
3740 | { |
3741 | .procname = "nf_conntrack_frag6_high_thresh", |
3742 | .data = &init_net.nf_frag.frags.high_thresh, |
3743 | - .maxlen = sizeof(unsigned int), |
3744 | + .maxlen = sizeof(unsigned long), |
3745 | .mode = 0644, |
3746 | - .proc_handler = proc_dointvec_minmax, |
3747 | + .proc_handler = proc_doulongvec_minmax, |
3748 | .extra1 = &init_net.nf_frag.frags.low_thresh |
3749 | }, |
3750 | { } |
3751 | @@ -152,23 +150,6 @@ static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h) |
3752 | return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK); |
3753 | } |
3754 | |
3755 | -static unsigned int nf_hash_frag(__be32 id, const struct in6_addr *saddr, |
3756 | - const struct in6_addr *daddr) |
3757 | -{ |
3758 | - net_get_random_once(&nf_frags.rnd, sizeof(nf_frags.rnd)); |
3759 | - return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), |
3760 | - (__force u32)id, nf_frags.rnd); |
3761 | -} |
3762 | - |
3763 | - |
3764 | -static unsigned int nf_hashfn(const struct inet_frag_queue *q) |
3765 | -{ |
3766 | - const struct frag_queue *nq; |
3767 | - |
3768 | - nq = container_of(q, struct frag_queue, q); |
3769 | - return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr); |
3770 | -} |
3771 | - |
3772 | static void nf_ct_frag6_expire(unsigned long data) |
3773 | { |
3774 | struct frag_queue *fq; |
3775 | @@ -177,34 +158,26 @@ static void nf_ct_frag6_expire(unsigned long data) |
3776 | fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); |
3777 | net = container_of(fq->q.net, struct net, nf_frag.frags); |
3778 | |
3779 | - ip6_expire_frag_queue(net, fq, &nf_frags); |
3780 | + ip6_expire_frag_queue(net, fq); |
3781 | } |
3782 | |
3783 | /* Creation primitives. */ |
3784 | -static inline struct frag_queue *fq_find(struct net *net, __be32 id, |
3785 | - u32 user, struct in6_addr *src, |
3786 | - struct in6_addr *dst, int iif, u8 ecn) |
3787 | +static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, |
3788 | + const struct ipv6hdr *hdr, int iif) |
3789 | { |
3790 | + struct frag_v6_compare_key key = { |
3791 | + .id = id, |
3792 | + .saddr = hdr->saddr, |
3793 | + .daddr = hdr->daddr, |
3794 | + .user = user, |
3795 | + .iif = iif, |
3796 | + }; |
3797 | struct inet_frag_queue *q; |
3798 | - struct ip6_create_arg arg; |
3799 | - unsigned int hash; |
3800 | - |
3801 | - arg.id = id; |
3802 | - arg.user = user; |
3803 | - arg.src = src; |
3804 | - arg.dst = dst; |
3805 | - arg.iif = iif; |
3806 | - arg.ecn = ecn; |
3807 | - |
3808 | - local_bh_disable(); |
3809 | - hash = nf_hash_frag(id, src, dst); |
3810 | - |
3811 | - q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash); |
3812 | - local_bh_enable(); |
3813 | - if (IS_ERR_OR_NULL(q)) { |
3814 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
3815 | + |
3816 | + q = inet_frag_find(&net->nf_frag.frags, &key); |
3817 | + if (!q) |
3818 | return NULL; |
3819 | - } |
3820 | + |
3821 | return container_of(q, struct frag_queue, q); |
3822 | } |
3823 | |
3824 | @@ -263,7 +236,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, |
3825 | * this case. -DaveM |
3826 | */ |
3827 | pr_debug("end of fragment not rounded to 8 bytes.\n"); |
3828 | - inet_frag_kill(&fq->q, &nf_frags); |
3829 | + inet_frag_kill(&fq->q); |
3830 | return -EPROTO; |
3831 | } |
3832 | if (end > fq->q.len) { |
3833 | @@ -356,7 +329,7 @@ found: |
3834 | return 0; |
3835 | |
3836 | discard_fq: |
3837 | - inet_frag_kill(&fq->q, &nf_frags); |
3838 | + inet_frag_kill(&fq->q); |
3839 | err: |
3840 | return -EINVAL; |
3841 | } |
3842 | @@ -378,7 +351,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic |
3843 | int payload_len; |
3844 | u8 ecn; |
3845 | |
3846 | - inet_frag_kill(&fq->q, &nf_frags); |
3847 | + inet_frag_kill(&fq->q); |
3848 | |
3849 | WARN_ON(head == NULL); |
3850 | WARN_ON(NFCT_FRAG6_CB(head)->offset != 0); |
3851 | @@ -479,6 +452,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic |
3852 | else if (head->ip_summed == CHECKSUM_COMPLETE) |
3853 | head->csum = csum_add(head->csum, fp->csum); |
3854 | head->truesize += fp->truesize; |
3855 | + fp->sk = NULL; |
3856 | } |
3857 | sub_frag_mem_limit(fq->q.net, head->truesize); |
3858 | |
3859 | @@ -497,6 +471,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic |
3860 | head->csum); |
3861 | |
3862 | fq->q.fragments = NULL; |
3863 | + fq->q.rb_fragments = RB_ROOT; |
3864 | fq->q.fragments_tail = NULL; |
3865 | |
3866 | return true; |
3867 | @@ -591,9 +566,13 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) |
3868 | hdr = ipv6_hdr(skb); |
3869 | fhdr = (struct frag_hdr *)skb_transport_header(skb); |
3870 | |
3871 | + if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && |
3872 | + fhdr->frag_off & htons(IP6_MF)) |
3873 | + return -EINVAL; |
3874 | + |
3875 | skb_orphan(skb); |
3876 | - fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, |
3877 | - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); |
3878 | + fq = fq_find(net, fhdr->identification, user, hdr, |
3879 | + skb->dev ? skb->dev->ifindex : 0); |
3880 | if (fq == NULL) { |
3881 | pr_debug("Can't find and can't create new queue\n"); |
3882 | return -ENOMEM; |
3883 | @@ -623,25 +602,33 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) |
3884 | |
3885 | out_unlock: |
3886 | spin_unlock_bh(&fq->q.lock); |
3887 | - inet_frag_put(&fq->q, &nf_frags); |
3888 | + inet_frag_put(&fq->q); |
3889 | return ret; |
3890 | } |
3891 | EXPORT_SYMBOL_GPL(nf_ct_frag6_gather); |
3892 | |
3893 | static int nf_ct_net_init(struct net *net) |
3894 | { |
3895 | + int res; |
3896 | + |
3897 | net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; |
3898 | net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH; |
3899 | net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT; |
3900 | - inet_frags_init_net(&net->nf_frag.frags); |
3901 | - |
3902 | - return nf_ct_frag6_sysctl_register(net); |
3903 | + net->nf_frag.frags.f = &nf_frags; |
3904 | + |
3905 | + res = inet_frags_init_net(&net->nf_frag.frags); |
3906 | + if (res < 0) |
3907 | + return res; |
3908 | + res = nf_ct_frag6_sysctl_register(net); |
3909 | + if (res < 0) |
3910 | + inet_frags_exit_net(&net->nf_frag.frags); |
3911 | + return res; |
3912 | } |
3913 | |
3914 | static void nf_ct_net_exit(struct net *net) |
3915 | { |
3916 | nf_ct_frags6_sysctl_unregister(net); |
3917 | - inet_frags_exit_net(&net->nf_frag.frags, &nf_frags); |
3918 | + inet_frags_exit_net(&net->nf_frag.frags); |
3919 | } |
3920 | |
3921 | static struct pernet_operations nf_ct_net_ops = { |
3922 | @@ -653,13 +640,12 @@ int nf_ct_frag6_init(void) |
3923 | { |
3924 | int ret = 0; |
3925 | |
3926 | - nf_frags.hashfn = nf_hashfn; |
3927 | nf_frags.constructor = ip6_frag_init; |
3928 | nf_frags.destructor = NULL; |
3929 | nf_frags.qsize = sizeof(struct frag_queue); |
3930 | - nf_frags.match = ip6_frag_match; |
3931 | nf_frags.frag_expire = nf_ct_frag6_expire; |
3932 | nf_frags.frags_cache_name = nf_frags_cache_name; |
3933 | + nf_frags.rhash_params = ip6_rhash_params; |
3934 | ret = inet_frags_init(&nf_frags); |
3935 | if (ret) |
3936 | goto out; |
3937 | diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c |
3938 | index e88bcb8ff0fd..dc04c024986c 100644 |
3939 | --- a/net/ipv6/proc.c |
3940 | +++ b/net/ipv6/proc.c |
3941 | @@ -38,7 +38,6 @@ |
3942 | static int sockstat6_seq_show(struct seq_file *seq, void *v) |
3943 | { |
3944 | struct net *net = seq->private; |
3945 | - unsigned int frag_mem = ip6_frag_mem(net); |
3946 | |
3947 | seq_printf(seq, "TCP6: inuse %d\n", |
3948 | sock_prot_inuse_get(net, &tcpv6_prot)); |
3949 | @@ -48,7 +47,9 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v) |
3950 | sock_prot_inuse_get(net, &udplitev6_prot)); |
3951 | seq_printf(seq, "RAW6: inuse %d\n", |
3952 | sock_prot_inuse_get(net, &rawv6_prot)); |
3953 | - seq_printf(seq, "FRAG6: inuse %u memory %u\n", !!frag_mem, frag_mem); |
3954 | + seq_printf(seq, "FRAG6: inuse %u memory %lu\n", |
3955 | + atomic_read(&net->ipv6.frags.rhashtable.nelems), |
3956 | + frag_mem_limit(&net->ipv6.frags)); |
3957 | return 0; |
3958 | } |
3959 | |
3960 | diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c |
3961 | index 71ffa526cb23..a4f979ff31b9 100644 |
3962 | --- a/net/ipv6/raw.c |
3963 | +++ b/net/ipv6/raw.c |
3964 | @@ -645,8 +645,6 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, |
3965 | skb->protocol = htons(ETH_P_IPV6); |
3966 | skb->priority = sk->sk_priority; |
3967 | skb->mark = sk->sk_mark; |
3968 | - skb_dst_set(skb, &rt->dst); |
3969 | - *dstp = NULL; |
3970 | |
3971 | skb_put(skb, length); |
3972 | skb_reset_network_header(skb); |
3973 | @@ -656,8 +654,14 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, |
3974 | |
3975 | skb->transport_header = skb->network_header; |
3976 | err = memcpy_from_msg(iph, msg, length); |
3977 | - if (err) |
3978 | - goto error_fault; |
3979 | + if (err) { |
3980 | + err = -EFAULT; |
3981 | + kfree_skb(skb); |
3982 | + goto error; |
3983 | + } |
3984 | + |
3985 | + skb_dst_set(skb, &rt->dst); |
3986 | + *dstp = NULL; |
3987 | |
3988 | /* if egress device is enslaved to an L3 master device pass the |
3989 | * skb to its handler for processing |
3990 | @@ -666,21 +670,28 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, |
3991 | if (unlikely(!skb)) |
3992 | return 0; |
3993 | |
3994 | + /* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev |
3995 | + * in the error path. Since skb has been freed, the dst could |
3996 | + * have been queued for deletion. |
3997 | + */ |
3998 | + rcu_read_lock(); |
3999 | IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len); |
4000 | err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk, skb, |
4001 | NULL, rt->dst.dev, dst_output); |
4002 | if (err > 0) |
4003 | err = net_xmit_errno(err); |
4004 | - if (err) |
4005 | - goto error; |
4006 | + if (err) { |
4007 | + IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); |
4008 | + rcu_read_unlock(); |
4009 | + goto error_check; |
4010 | + } |
4011 | + rcu_read_unlock(); |
4012 | out: |
4013 | return 0; |
4014 | |
4015 | -error_fault: |
4016 | - err = -EFAULT; |
4017 | - kfree_skb(skb); |
4018 | error: |
4019 | IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); |
4020 | +error_check: |
4021 | if (err == -ENOBUFS && !np->recverr) |
4022 | err = 0; |
4023 | return err; |
4024 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c |
4025 | index e585c0a2591c..74ffbcb306a6 100644 |
4026 | --- a/net/ipv6/reassembly.c |
4027 | +++ b/net/ipv6/reassembly.c |
4028 | @@ -79,94 +79,58 @@ static struct inet_frags ip6_frags; |
4029 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
4030 | struct net_device *dev); |
4031 | |
4032 | -/* |
4033 | - * callers should be careful not to use the hash value outside the ipfrag_lock |
4034 | - * as doing so could race with ipfrag_hash_rnd being recalculated. |
4035 | - */ |
4036 | -static unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, |
4037 | - const struct in6_addr *daddr) |
4038 | -{ |
4039 | - net_get_random_once(&ip6_frags.rnd, sizeof(ip6_frags.rnd)); |
4040 | - return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), |
4041 | - (__force u32)id, ip6_frags.rnd); |
4042 | -} |
4043 | - |
4044 | -static unsigned int ip6_hashfn(const struct inet_frag_queue *q) |
4045 | -{ |
4046 | - const struct frag_queue *fq; |
4047 | - |
4048 | - fq = container_of(q, struct frag_queue, q); |
4049 | - return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr); |
4050 | -} |
4051 | - |
4052 | -bool ip6_frag_match(const struct inet_frag_queue *q, const void *a) |
4053 | -{ |
4054 | - const struct frag_queue *fq; |
4055 | - const struct ip6_create_arg *arg = a; |
4056 | - |
4057 | - fq = container_of(q, struct frag_queue, q); |
4058 | - return fq->id == arg->id && |
4059 | - fq->user == arg->user && |
4060 | - ipv6_addr_equal(&fq->saddr, arg->src) && |
4061 | - ipv6_addr_equal(&fq->daddr, arg->dst) && |
4062 | - (arg->iif == fq->iif || |
4063 | - !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST | |
4064 | - IPV6_ADDR_LINKLOCAL))); |
4065 | -} |
4066 | -EXPORT_SYMBOL(ip6_frag_match); |
4067 | - |
4068 | void ip6_frag_init(struct inet_frag_queue *q, const void *a) |
4069 | { |
4070 | struct frag_queue *fq = container_of(q, struct frag_queue, q); |
4071 | - const struct ip6_create_arg *arg = a; |
4072 | + const struct frag_v6_compare_key *key = a; |
4073 | |
4074 | - fq->id = arg->id; |
4075 | - fq->user = arg->user; |
4076 | - fq->saddr = *arg->src; |
4077 | - fq->daddr = *arg->dst; |
4078 | - fq->ecn = arg->ecn; |
4079 | + q->key.v6 = *key; |
4080 | + fq->ecn = 0; |
4081 | } |
4082 | EXPORT_SYMBOL(ip6_frag_init); |
4083 | |
4084 | -void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, |
4085 | - struct inet_frags *frags) |
4086 | +void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq) |
4087 | { |
4088 | struct net_device *dev = NULL; |
4089 | + struct sk_buff *head; |
4090 | |
4091 | + rcu_read_lock(); |
4092 | spin_lock(&fq->q.lock); |
4093 | |
4094 | if (fq->q.flags & INET_FRAG_COMPLETE) |
4095 | goto out; |
4096 | |
4097 | - inet_frag_kill(&fq->q, frags); |
4098 | + inet_frag_kill(&fq->q); |
4099 | |
4100 | - rcu_read_lock(); |
4101 | dev = dev_get_by_index_rcu(net, fq->iif); |
4102 | if (!dev) |
4103 | - goto out_rcu_unlock; |
4104 | + goto out; |
4105 | |
4106 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); |
4107 | - |
4108 | - if (inet_frag_evicting(&fq->q)) |
4109 | - goto out_rcu_unlock; |
4110 | - |
4111 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); |
4112 | |
4113 | /* Don't send error if the first segment did not arrive. */ |
4114 | - if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !fq->q.fragments) |
4115 | - goto out_rcu_unlock; |
4116 | + head = fq->q.fragments; |
4117 | + if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !head) |
4118 | + goto out; |
4119 | |
4120 | /* But use as source device on which LAST ARRIVED |
4121 | * segment was received. And do not use fq->dev |
4122 | * pointer directly, device might already disappeared. |
4123 | */ |
4124 | - fq->q.fragments->dev = dev; |
4125 | - icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); |
4126 | -out_rcu_unlock: |
4127 | - rcu_read_unlock(); |
4128 | + head->dev = dev; |
4129 | + skb_get(head); |
4130 | + spin_unlock(&fq->q.lock); |
4131 | + |
4132 | + icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); |
4133 | + kfree_skb(head); |
4134 | + goto out_rcu_unlock; |
4135 | + |
4136 | out: |
4137 | spin_unlock(&fq->q.lock); |
4138 | - inet_frag_put(&fq->q, frags); |
4139 | +out_rcu_unlock: |
4140 | + rcu_read_unlock(); |
4141 | + inet_frag_put(&fq->q); |
4142 | } |
4143 | EXPORT_SYMBOL(ip6_expire_frag_queue); |
4144 | |
4145 | @@ -178,31 +142,29 @@ static void ip6_frag_expire(unsigned long data) |
4146 | fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); |
4147 | net = container_of(fq->q.net, struct net, ipv6.frags); |
4148 | |
4149 | - ip6_expire_frag_queue(net, fq, &ip6_frags); |
4150 | + ip6_expire_frag_queue(net, fq); |
4151 | } |
4152 | |
4153 | static struct frag_queue * |
4154 | -fq_find(struct net *net, __be32 id, const struct in6_addr *src, |
4155 | - const struct in6_addr *dst, int iif, u8 ecn) |
4156 | +fq_find(struct net *net, __be32 id, const struct ipv6hdr *hdr, int iif) |
4157 | { |
4158 | + struct frag_v6_compare_key key = { |
4159 | + .id = id, |
4160 | + .saddr = hdr->saddr, |
4161 | + .daddr = hdr->daddr, |
4162 | + .user = IP6_DEFRAG_LOCAL_DELIVER, |
4163 | + .iif = iif, |
4164 | + }; |
4165 | struct inet_frag_queue *q; |
4166 | - struct ip6_create_arg arg; |
4167 | - unsigned int hash; |
4168 | |
4169 | - arg.id = id; |
4170 | - arg.user = IP6_DEFRAG_LOCAL_DELIVER; |
4171 | - arg.src = src; |
4172 | - arg.dst = dst; |
4173 | - arg.iif = iif; |
4174 | - arg.ecn = ecn; |
4175 | + if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST | |
4176 | + IPV6_ADDR_LINKLOCAL))) |
4177 | + key.iif = 0; |
4178 | |
4179 | - hash = inet6_hash_frag(id, src, dst); |
4180 | - |
4181 | - q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); |
4182 | - if (IS_ERR_OR_NULL(q)) { |
4183 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); |
4184 | + q = inet_frag_find(&net->ipv6.frags, &key); |
4185 | + if (!q) |
4186 | return NULL; |
4187 | - } |
4188 | + |
4189 | return container_of(q, struct frag_queue, q); |
4190 | } |
4191 | |
4192 | @@ -359,7 +321,7 @@ found: |
4193 | return -1; |
4194 | |
4195 | discard_fq: |
4196 | - inet_frag_kill(&fq->q, &ip6_frags); |
4197 | + inet_frag_kill(&fq->q); |
4198 | err: |
4199 | __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), |
4200 | IPSTATS_MIB_REASMFAILS); |
4201 | @@ -386,7 +348,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
4202 | int sum_truesize; |
4203 | u8 ecn; |
4204 | |
4205 | - inet_frag_kill(&fq->q, &ip6_frags); |
4206 | + inet_frag_kill(&fq->q); |
4207 | |
4208 | ecn = ip_frag_ecn_table[fq->ecn]; |
4209 | if (unlikely(ecn == 0xff)) |
4210 | @@ -504,6 +466,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
4211 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS); |
4212 | rcu_read_unlock(); |
4213 | fq->q.fragments = NULL; |
4214 | + fq->q.rb_fragments = RB_ROOT; |
4215 | fq->q.fragments_tail = NULL; |
4216 | return 1; |
4217 | |
4218 | @@ -525,6 +488,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
4219 | struct frag_queue *fq; |
4220 | const struct ipv6hdr *hdr = ipv6_hdr(skb); |
4221 | struct net *net = dev_net(skb_dst(skb)->dev); |
4222 | + int iif; |
4223 | |
4224 | if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED) |
4225 | goto fail_hdr; |
4226 | @@ -553,17 +517,22 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
4227 | return 1; |
4228 | } |
4229 | |
4230 | - fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, |
4231 | - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); |
4232 | + if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && |
4233 | + fhdr->frag_off & htons(IP6_MF)) |
4234 | + goto fail_hdr; |
4235 | + |
4236 | + iif = skb->dev ? skb->dev->ifindex : 0; |
4237 | + fq = fq_find(net, fhdr->identification, hdr, iif); |
4238 | if (fq) { |
4239 | int ret; |
4240 | |
4241 | spin_lock(&fq->q.lock); |
4242 | |
4243 | + fq->iif = iif; |
4244 | ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff); |
4245 | |
4246 | spin_unlock(&fq->q.lock); |
4247 | - inet_frag_put(&fq->q, &ip6_frags); |
4248 | + inet_frag_put(&fq->q); |
4249 | return ret; |
4250 | } |
4251 | |
4252 | @@ -584,24 +553,22 @@ static const struct inet6_protocol frag_protocol = { |
4253 | }; |
4254 | |
4255 | #ifdef CONFIG_SYSCTL |
4256 | -static int zero; |
4257 | |
4258 | static struct ctl_table ip6_frags_ns_ctl_table[] = { |
4259 | { |
4260 | .procname = "ip6frag_high_thresh", |
4261 | .data = &init_net.ipv6.frags.high_thresh, |
4262 | - .maxlen = sizeof(int), |
4263 | + .maxlen = sizeof(unsigned long), |
4264 | .mode = 0644, |
4265 | - .proc_handler = proc_dointvec_minmax, |
4266 | + .proc_handler = proc_doulongvec_minmax, |
4267 | .extra1 = &init_net.ipv6.frags.low_thresh |
4268 | }, |
4269 | { |
4270 | .procname = "ip6frag_low_thresh", |
4271 | .data = &init_net.ipv6.frags.low_thresh, |
4272 | - .maxlen = sizeof(int), |
4273 | + .maxlen = sizeof(unsigned long), |
4274 | .mode = 0644, |
4275 | - .proc_handler = proc_dointvec_minmax, |
4276 | - .extra1 = &zero, |
4277 | + .proc_handler = proc_doulongvec_minmax, |
4278 | .extra2 = &init_net.ipv6.frags.high_thresh |
4279 | }, |
4280 | { |
4281 | @@ -644,10 +611,6 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net) |
4282 | table[1].data = &net->ipv6.frags.low_thresh; |
4283 | table[1].extra2 = &net->ipv6.frags.high_thresh; |
4284 | table[2].data = &net->ipv6.frags.timeout; |
4285 | - |
4286 | - /* Don't export sysctls to unprivileged users */ |
4287 | - if (net->user_ns != &init_user_ns) |
4288 | - table[0].procname = NULL; |
4289 | } |
4290 | |
4291 | hdr = register_net_sysctl(net, "net/ipv6", table); |
4292 | @@ -709,19 +672,27 @@ static void ip6_frags_sysctl_unregister(void) |
4293 | |
4294 | static int __net_init ipv6_frags_init_net(struct net *net) |
4295 | { |
4296 | + int res; |
4297 | + |
4298 | net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; |
4299 | net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH; |
4300 | net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; |
4301 | + net->ipv6.frags.f = &ip6_frags; |
4302 | |
4303 | - inet_frags_init_net(&net->ipv6.frags); |
4304 | + res = inet_frags_init_net(&net->ipv6.frags); |
4305 | + if (res < 0) |
4306 | + return res; |
4307 | |
4308 | - return ip6_frags_ns_sysctl_register(net); |
4309 | + res = ip6_frags_ns_sysctl_register(net); |
4310 | + if (res < 0) |
4311 | + inet_frags_exit_net(&net->ipv6.frags); |
4312 | + return res; |
4313 | } |
4314 | |
4315 | static void __net_exit ipv6_frags_exit_net(struct net *net) |
4316 | { |
4317 | ip6_frags_ns_sysctl_unregister(net); |
4318 | - inet_frags_exit_net(&net->ipv6.frags, &ip6_frags); |
4319 | + inet_frags_exit_net(&net->ipv6.frags); |
4320 | } |
4321 | |
4322 | static struct pernet_operations ip6_frags_ops = { |
4323 | @@ -729,14 +700,55 @@ static struct pernet_operations ip6_frags_ops = { |
4324 | .exit = ipv6_frags_exit_net, |
4325 | }; |
4326 | |
4327 | +static u32 ip6_key_hashfn(const void *data, u32 len, u32 seed) |
4328 | +{ |
4329 | + return jhash2(data, |
4330 | + sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); |
4331 | +} |
4332 | + |
4333 | +static u32 ip6_obj_hashfn(const void *data, u32 len, u32 seed) |
4334 | +{ |
4335 | + const struct inet_frag_queue *fq = data; |
4336 | + |
4337 | + return jhash2((const u32 *)&fq->key.v6, |
4338 | + sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); |
4339 | +} |
4340 | + |
4341 | +static int ip6_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) |
4342 | +{ |
4343 | + const struct frag_v6_compare_key *key = arg->key; |
4344 | + const struct inet_frag_queue *fq = ptr; |
4345 | + |
4346 | + return !!memcmp(&fq->key, key, sizeof(*key)); |
4347 | +} |
4348 | + |
4349 | +const struct rhashtable_params ip6_rhash_params = { |
4350 | + .head_offset = offsetof(struct inet_frag_queue, node), |
4351 | + .hashfn = ip6_key_hashfn, |
4352 | + .obj_hashfn = ip6_obj_hashfn, |
4353 | + .obj_cmpfn = ip6_obj_cmpfn, |
4354 | + .automatic_shrinking = true, |
4355 | +}; |
4356 | +EXPORT_SYMBOL(ip6_rhash_params); |
4357 | + |
4358 | int __init ipv6_frag_init(void) |
4359 | { |
4360 | int ret; |
4361 | |
4362 | - ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
4363 | + ip6_frags.constructor = ip6_frag_init; |
4364 | + ip6_frags.destructor = NULL; |
4365 | + ip6_frags.qsize = sizeof(struct frag_queue); |
4366 | + ip6_frags.frag_expire = ip6_frag_expire; |
4367 | + ip6_frags.frags_cache_name = ip6_frag_cache_name; |
4368 | + ip6_frags.rhash_params = ip6_rhash_params; |
4369 | + ret = inet_frags_init(&ip6_frags); |
4370 | if (ret) |
4371 | goto out; |
4372 | |
4373 | + ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
4374 | + if (ret) |
4375 | + goto err_protocol; |
4376 | + |
4377 | ret = ip6_frags_sysctl_register(); |
4378 | if (ret) |
4379 | goto err_sysctl; |
4380 | @@ -745,16 +757,6 @@ int __init ipv6_frag_init(void) |
4381 | if (ret) |
4382 | goto err_pernet; |
4383 | |
4384 | - ip6_frags.hashfn = ip6_hashfn; |
4385 | - ip6_frags.constructor = ip6_frag_init; |
4386 | - ip6_frags.destructor = NULL; |
4387 | - ip6_frags.qsize = sizeof(struct frag_queue); |
4388 | - ip6_frags.match = ip6_frag_match; |
4389 | - ip6_frags.frag_expire = ip6_frag_expire; |
4390 | - ip6_frags.frags_cache_name = ip6_frag_cache_name; |
4391 | - ret = inet_frags_init(&ip6_frags); |
4392 | - if (ret) |
4393 | - goto err_pernet; |
4394 | out: |
4395 | return ret; |
4396 | |
4397 | @@ -762,6 +764,8 @@ err_pernet: |
4398 | ip6_frags_sysctl_unregister(); |
4399 | err_sysctl: |
4400 | inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); |
4401 | +err_protocol: |
4402 | + inet_frags_fini(&ip6_frags); |
4403 | goto out; |
4404 | } |
4405 | |
4406 | diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c |
4407 | index a123d0dc1ef9..053ba8646155 100644 |
4408 | --- a/net/netlabel/netlabel_unlabeled.c |
4409 | +++ b/net/netlabel/netlabel_unlabeled.c |
4410 | @@ -787,7 +787,8 @@ static int netlbl_unlabel_addrinfo_get(struct genl_info *info, |
4411 | { |
4412 | u32 addr_len; |
4413 | |
4414 | - if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { |
4415 | + if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] && |
4416 | + info->attrs[NLBL_UNLABEL_A_IPV4MASK]) { |
4417 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); |
4418 | if (addr_len != sizeof(struct in_addr) && |
4419 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) |
4420 | diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c |
4421 | index 8761877207ec..00c6af2ae1c2 100644 |
4422 | --- a/sound/hda/hdac_controller.c |
4423 | +++ b/sound/hda/hdac_controller.c |
4424 | @@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac_bus *bus) |
4425 | */ |
4426 | void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus) |
4427 | { |
4428 | + WARN_ON_ONCE(!bus->rb.area); |
4429 | + |
4430 | spin_lock_irq(&bus->reg_lock); |
4431 | /* CORB set up */ |
4432 | bus->corb.addr = bus->rb.addr; |
4433 | @@ -478,13 +480,15 @@ bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset) |
4434 | /* reset controller */ |
4435 | azx_reset(bus, full_reset); |
4436 | |
4437 | - /* initialize interrupts */ |
4438 | + /* clear interrupts */ |
4439 | azx_int_clear(bus); |
4440 | - azx_int_enable(bus); |
4441 | |
4442 | /* initialize the codec command I/O */ |
4443 | snd_hdac_bus_init_cmd_io(bus); |
4444 | |
4445 | + /* enable interrupts after CORB/RIRB buffers are initialized above */ |
4446 | + azx_int_enable(bus); |
4447 | + |
4448 | /* program the position buffer */ |
4449 | if (bus->use_posbuf && bus->posbuf.addr) { |
4450 | snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr); |
4451 | diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c |
4452 | index d53680ac78e4..6df158669420 100644 |
4453 | --- a/sound/soc/codecs/sigmadsp.c |
4454 | +++ b/sound/soc/codecs/sigmadsp.c |
4455 | @@ -117,8 +117,7 @@ static int sigmadsp_ctrl_write(struct sigmadsp *sigmadsp, |
4456 | struct sigmadsp_control *ctrl, void *data) |
4457 | { |
4458 | /* safeload loads up to 20 bytes in a atomic operation */ |
4459 | - if (ctrl->num_bytes > 4 && ctrl->num_bytes <= 20 && sigmadsp->ops && |
4460 | - sigmadsp->ops->safeload) |
4461 | + if (ctrl->num_bytes <= 20 && sigmadsp->ops && sigmadsp->ops->safeload) |
4462 | return sigmadsp->ops->safeload(sigmadsp, ctrl->addr, data, |
4463 | ctrl->num_bytes); |
4464 | else |
4465 | diff --git a/sound/soc/codecs/wm8804-i2c.c b/sound/soc/codecs/wm8804-i2c.c |
4466 | index f27464c2c5ba..79541960f45d 100644 |
4467 | --- a/sound/soc/codecs/wm8804-i2c.c |
4468 | +++ b/sound/soc/codecs/wm8804-i2c.c |
4469 | @@ -13,6 +13,7 @@ |
4470 | #include <linux/init.h> |
4471 | #include <linux/module.h> |
4472 | #include <linux/i2c.h> |
4473 | +#include <linux/acpi.h> |
4474 | |
4475 | #include "wm8804.h" |
4476 | |
4477 | @@ -40,17 +41,29 @@ static const struct i2c_device_id wm8804_i2c_id[] = { |
4478 | }; |
4479 | MODULE_DEVICE_TABLE(i2c, wm8804_i2c_id); |
4480 | |
4481 | +#if defined(CONFIG_OF) |
4482 | static const struct of_device_id wm8804_of_match[] = { |
4483 | { .compatible = "wlf,wm8804", }, |
4484 | { } |
4485 | }; |
4486 | MODULE_DEVICE_TABLE(of, wm8804_of_match); |
4487 | +#endif |
4488 | + |
4489 | +#ifdef CONFIG_ACPI |
4490 | +static const struct acpi_device_id wm8804_acpi_match[] = { |
4491 | + { "1AEC8804", 0 }, /* Wolfson PCI ID + part ID */ |
4492 | + { "10138804", 0 }, /* Cirrus Logic PCI ID + part ID */ |
4493 | + { }, |
4494 | +}; |
4495 | +MODULE_DEVICE_TABLE(acpi, wm8804_acpi_match); |
4496 | +#endif |
4497 | |
4498 | static struct i2c_driver wm8804_i2c_driver = { |
4499 | .driver = { |
4500 | .name = "wm8804", |
4501 | .pm = &wm8804_pm, |
4502 | - .of_match_table = wm8804_of_match, |
4503 | + .of_match_table = of_match_ptr(wm8804_of_match), |
4504 | + .acpi_match_table = ACPI_PTR(wm8804_acpi_match), |
4505 | }, |
4506 | .probe = wm8804_i2c_probe, |
4507 | .remove = wm8804_i2c_remove, |
4508 | diff --git a/tools/perf/scripts/python/export-to-postgresql.py b/tools/perf/scripts/python/export-to-postgresql.py |
4509 | index 7656ff8aa066..c001d5a91d22 100644 |
4510 | --- a/tools/perf/scripts/python/export-to-postgresql.py |
4511 | +++ b/tools/perf/scripts/python/export-to-postgresql.py |
4512 | @@ -204,14 +204,23 @@ from ctypes import * |
4513 | libpq = CDLL("libpq.so.5") |
4514 | PQconnectdb = libpq.PQconnectdb |
4515 | PQconnectdb.restype = c_void_p |
4516 | +PQconnectdb.argtypes = [ c_char_p ] |
4517 | PQfinish = libpq.PQfinish |
4518 | +PQfinish.argtypes = [ c_void_p ] |
4519 | PQstatus = libpq.PQstatus |
4520 | +PQstatus.restype = c_int |
4521 | +PQstatus.argtypes = [ c_void_p ] |
4522 | PQexec = libpq.PQexec |
4523 | PQexec.restype = c_void_p |
4524 | +PQexec.argtypes = [ c_void_p, c_char_p ] |
4525 | PQresultStatus = libpq.PQresultStatus |
4526 | +PQresultStatus.restype = c_int |
4527 | +PQresultStatus.argtypes = [ c_void_p ] |
4528 | PQputCopyData = libpq.PQputCopyData |
4529 | +PQputCopyData.restype = c_int |
4530 | PQputCopyData.argtypes = [ c_void_p, c_void_p, c_int ] |
4531 | PQputCopyEnd = libpq.PQputCopyEnd |
4532 | +PQputCopyEnd.restype = c_int |
4533 | PQputCopyEnd.argtypes = [ c_void_p, c_void_p ] |
4534 | |
4535 | sys.path.append(os.environ['PERF_EXEC_PATH'] + \ |
4536 | diff --git a/tools/testing/selftests/efivarfs/config b/tools/testing/selftests/efivarfs/config |
4537 | new file mode 100644 |
4538 | index 000000000000..4e151f1005b2 |
4539 | --- /dev/null |
4540 | +++ b/tools/testing/selftests/efivarfs/config |
4541 | @@ -0,0 +1 @@ |
4542 | +CONFIG_EFIVAR_FS=y |
4543 | diff --git a/tools/testing/selftests/memory-hotplug/config b/tools/testing/selftests/memory-hotplug/config |
4544 | index 2fde30191a47..a7e8cd5bb265 100644 |
4545 | --- a/tools/testing/selftests/memory-hotplug/config |
4546 | +++ b/tools/testing/selftests/memory-hotplug/config |
4547 | @@ -2,3 +2,4 @@ CONFIG_MEMORY_HOTPLUG=y |
4548 | CONFIG_MEMORY_HOTPLUG_SPARSE=y |
4549 | CONFIG_NOTIFIER_ERROR_INJECTION=y |
4550 | CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m |
4551 | +CONFIG_MEMORY_HOTREMOVE=y |