Annotation of /trunk/kernel-alx/patches-4.9/0233-4.9.134-all-fixes.patch
Parent Directory | Revision Log
Revision 3235 -
(hide annotations)
(download)
Thu Oct 18 08:37:27 2018 UTC (5 years, 11 months ago) by niro
File size: 141982 byte(s)
Thu Oct 18 08:37:27 2018 UTC (5 years, 11 months ago) by niro
File size: 141982 byte(s)
-linux-4.9.134
1 | niro | 3235 | diff --git a/Documentation/devicetree/bindings/net/macb.txt b/Documentation/devicetree/bindings/net/macb.txt |
2 | index 1506e948610c..d1f435c92912 100644 | ||
3 | --- a/Documentation/devicetree/bindings/net/macb.txt | ||
4 | +++ b/Documentation/devicetree/bindings/net/macb.txt | ||
5 | @@ -10,6 +10,7 @@ Required properties: | ||
6 | Use "cdns,pc302-gem" for Picochip picoXcell pc302 and later devices based on | ||
7 | the Cadence GEM, or the generic form: "cdns,gem". | ||
8 | Use "atmel,sama5d2-gem" for the GEM IP (10/100) available on Atmel sama5d2 SoCs. | ||
9 | + Use "atmel,sama5d3-macb" for the 10/100Mbit IP available on Atmel sama5d3 SoCs. | ||
10 | Use "atmel,sama5d3-gem" for the Gigabit IP available on Atmel sama5d3 SoCs. | ||
11 | Use "atmel,sama5d4-gem" for the GEM IP (10/100) available on Atmel sama5d4 SoCs. | ||
12 | Use "cdns,zynq-gem" Xilinx Zynq-7xxx SoC. | ||
13 | diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt | ||
14 | index 3db8c67d2c8d..dbdc4130e149 100644 | ||
15 | --- a/Documentation/networking/ip-sysctl.txt | ||
16 | +++ b/Documentation/networking/ip-sysctl.txt | ||
17 | @@ -122,14 +122,11 @@ min_adv_mss - INTEGER | ||
18 | |||
19 | IP Fragmentation: | ||
20 | |||
21 | -ipfrag_high_thresh - INTEGER | ||
22 | - Maximum memory used to reassemble IP fragments. When | ||
23 | - ipfrag_high_thresh bytes of memory is allocated for this purpose, | ||
24 | - the fragment handler will toss packets until ipfrag_low_thresh | ||
25 | - is reached. This also serves as a maximum limit to namespaces | ||
26 | - different from the initial one. | ||
27 | - | ||
28 | -ipfrag_low_thresh - INTEGER | ||
29 | +ipfrag_high_thresh - LONG INTEGER | ||
30 | + Maximum memory used to reassemble IP fragments. | ||
31 | + | ||
32 | +ipfrag_low_thresh - LONG INTEGER | ||
33 | + (Obsolete since linux-4.17) | ||
34 | Maximum memory used to reassemble IP fragments before the kernel | ||
35 | begins to remove incomplete fragment queues to free up resources. | ||
36 | The kernel still accepts new fragments for defragmentation. | ||
37 | diff --git a/Makefile b/Makefile | ||
38 | index 18090f899a7c..46135e4333e6 100644 | ||
39 | --- a/Makefile | ||
40 | +++ b/Makefile | ||
41 | @@ -1,6 +1,6 @@ | ||
42 | VERSION = 4 | ||
43 | PATCHLEVEL = 9 | ||
44 | -SUBLEVEL = 133 | ||
45 | +SUBLEVEL = 134 | ||
46 | EXTRAVERSION = | ||
47 | NAME = Roaring Lionus | ||
48 | |||
49 | diff --git a/arch/arm/boot/dts/sama5d3_emac.dtsi b/arch/arm/boot/dts/sama5d3_emac.dtsi | ||
50 | index 7cb235ef0fb6..6e9e1c2f9def 100644 | ||
51 | --- a/arch/arm/boot/dts/sama5d3_emac.dtsi | ||
52 | +++ b/arch/arm/boot/dts/sama5d3_emac.dtsi | ||
53 | @@ -41,7 +41,7 @@ | ||
54 | }; | ||
55 | |||
56 | macb1: ethernet@f802c000 { | ||
57 | - compatible = "cdns,at91sam9260-macb", "cdns,macb"; | ||
58 | + compatible = "atmel,sama5d3-macb", "cdns,at91sam9260-macb", "cdns,macb"; | ||
59 | reg = <0xf802c000 0x100>; | ||
60 | interrupts = <35 IRQ_TYPE_LEVEL_HIGH 3>; | ||
61 | pinctrl-names = "default"; | ||
62 | diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h | ||
63 | index 739c0c594022..1bb90fafcdc3 100644 | ||
64 | --- a/arch/x86/include/uapi/asm/kvm.h | ||
65 | +++ b/arch/x86/include/uapi/asm/kvm.h | ||
66 | @@ -356,5 +356,6 @@ struct kvm_sync_regs { | ||
67 | |||
68 | #define KVM_X86_QUIRK_LINT0_REENABLED (1 << 0) | ||
69 | #define KVM_X86_QUIRK_CD_NW_CLEARED (1 << 1) | ||
70 | +#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE (1 << 2) | ||
71 | |||
72 | #endif /* _ASM_X86_KVM_H */ | ||
73 | diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c | ||
74 | index a8a86be8cf15..69a81a7daa24 100644 | ||
75 | --- a/arch/x86/kvm/lapic.c | ||
76 | +++ b/arch/x86/kvm/lapic.c | ||
77 | @@ -1220,9 +1220,8 @@ EXPORT_SYMBOL_GPL(kvm_lapic_reg_read); | ||
78 | |||
79 | static int apic_mmio_in_range(struct kvm_lapic *apic, gpa_t addr) | ||
80 | { | ||
81 | - return kvm_apic_hw_enabled(apic) && | ||
82 | - addr >= apic->base_address && | ||
83 | - addr < apic->base_address + LAPIC_MMIO_LENGTH; | ||
84 | + return addr >= apic->base_address && | ||
85 | + addr < apic->base_address + LAPIC_MMIO_LENGTH; | ||
86 | } | ||
87 | |||
88 | static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this, | ||
89 | @@ -1234,6 +1233,15 @@ static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this, | ||
90 | if (!apic_mmio_in_range(apic, address)) | ||
91 | return -EOPNOTSUPP; | ||
92 | |||
93 | + if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) { | ||
94 | + if (!kvm_check_has_quirk(vcpu->kvm, | ||
95 | + KVM_X86_QUIRK_LAPIC_MMIO_HOLE)) | ||
96 | + return -EOPNOTSUPP; | ||
97 | + | ||
98 | + memset(data, 0xff, len); | ||
99 | + return 0; | ||
100 | + } | ||
101 | + | ||
102 | kvm_lapic_reg_read(apic, offset, len, data); | ||
103 | |||
104 | return 0; | ||
105 | @@ -1646,6 +1654,14 @@ static int apic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this, | ||
106 | if (!apic_mmio_in_range(apic, address)) | ||
107 | return -EOPNOTSUPP; | ||
108 | |||
109 | + if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) { | ||
110 | + if (!kvm_check_has_quirk(vcpu->kvm, | ||
111 | + KVM_X86_QUIRK_LAPIC_MMIO_HOLE)) | ||
112 | + return -EOPNOTSUPP; | ||
113 | + | ||
114 | + return 0; | ||
115 | + } | ||
116 | + | ||
117 | /* | ||
118 | * APIC register must be aligned on 128-bits boundary. | ||
119 | * 32/64/128 bits registers must be accessed thru 32 bits. | ||
120 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c | ||
121 | index 47951f4775b9..d47c32a18da8 100644 | ||
122 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c | ||
123 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c | ||
124 | @@ -505,7 +505,7 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd, | ||
125 | |||
126 | while (true) { | ||
127 | temp = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS); | ||
128 | - if (temp & SDMA0_STATUS_REG__RB_CMD_IDLE__SHIFT) | ||
129 | + if (temp & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK) | ||
130 | break; | ||
131 | if (timeout <= 0) | ||
132 | return -ETIME; | ||
133 | diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c | ||
134 | index 7aa7b9cb6203..efefcfa24a4c 100644 | ||
135 | --- a/drivers/i2c/busses/i2c-scmi.c | ||
136 | +++ b/drivers/i2c/busses/i2c-scmi.c | ||
137 | @@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, | ||
138 | mt_params[3].type = ACPI_TYPE_INTEGER; | ||
139 | mt_params[3].integer.value = len; | ||
140 | mt_params[4].type = ACPI_TYPE_BUFFER; | ||
141 | + mt_params[4].buffer.length = len; | ||
142 | mt_params[4].buffer.pointer = data->block + 1; | ||
143 | } | ||
144 | break; | ||
145 | diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c | ||
146 | index 7aab376ecb84..3785c638d530 100644 | ||
147 | --- a/drivers/mfd/omap-usb-host.c | ||
148 | +++ b/drivers/mfd/omap-usb-host.c | ||
149 | @@ -548,8 +548,8 @@ static int usbhs_omap_get_dt_pdata(struct device *dev, | ||
150 | } | ||
151 | |||
152 | static const struct of_device_id usbhs_child_match_table[] = { | ||
153 | - { .compatible = "ti,omap-ehci", }, | ||
154 | - { .compatible = "ti,omap-ohci", }, | ||
155 | + { .compatible = "ti,ehci-omap", }, | ||
156 | + { .compatible = "ti,ohci-omap3", }, | ||
157 | { } | ||
158 | }; | ||
159 | |||
160 | @@ -875,6 +875,7 @@ static struct platform_driver usbhs_omap_driver = { | ||
161 | .pm = &usbhsomap_dev_pm_ops, | ||
162 | .of_match_table = usbhs_omap_dt_ids, | ||
163 | }, | ||
164 | + .probe = usbhs_omap_probe, | ||
165 | .remove = usbhs_omap_remove, | ||
166 | }; | ||
167 | |||
168 | @@ -884,9 +885,9 @@ MODULE_ALIAS("platform:" USBHS_DRIVER_NAME); | ||
169 | MODULE_LICENSE("GPL v2"); | ||
170 | MODULE_DESCRIPTION("usb host common core driver for omap EHCI and OHCI"); | ||
171 | |||
172 | -static int __init omap_usbhs_drvinit(void) | ||
173 | +static int omap_usbhs_drvinit(void) | ||
174 | { | ||
175 | - return platform_driver_probe(&usbhs_omap_driver, usbhs_omap_probe); | ||
176 | + return platform_driver_register(&usbhs_omap_driver); | ||
177 | } | ||
178 | |||
179 | /* | ||
180 | @@ -898,7 +899,7 @@ static int __init omap_usbhs_drvinit(void) | ||
181 | */ | ||
182 | fs_initcall_sync(omap_usbhs_drvinit); | ||
183 | |||
184 | -static void __exit omap_usbhs_drvexit(void) | ||
185 | +static void omap_usbhs_drvexit(void) | ||
186 | { | ||
187 | platform_driver_unregister(&usbhs_omap_driver); | ||
188 | } | ||
189 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c | ||
190 | index 8a5e0ae4e4c0..b1ea29d8ad1a 100644 | ||
191 | --- a/drivers/net/bonding/bond_main.c | ||
192 | +++ b/drivers/net/bonding/bond_main.c | ||
193 | @@ -216,6 +216,7 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev, | ||
194 | static void bond_slave_arr_handler(struct work_struct *work); | ||
195 | static bool bond_time_in_interval(struct bonding *bond, unsigned long last_act, | ||
196 | int mod); | ||
197 | +static void bond_netdev_notify_work(struct work_struct *work); | ||
198 | |||
199 | /*---------------------------- General routines -----------------------------*/ | ||
200 | |||
201 | @@ -1250,6 +1251,8 @@ static struct slave *bond_alloc_slave(struct bonding *bond) | ||
202 | return NULL; | ||
203 | } | ||
204 | } | ||
205 | + INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); | ||
206 | + | ||
207 | return slave; | ||
208 | } | ||
209 | |||
210 | @@ -1257,6 +1260,7 @@ static void bond_free_slave(struct slave *slave) | ||
211 | { | ||
212 | struct bonding *bond = bond_get_bond_by_slave(slave); | ||
213 | |||
214 | + cancel_delayed_work_sync(&slave->notify_work); | ||
215 | if (BOND_MODE(bond) == BOND_MODE_8023AD) | ||
216 | kfree(SLAVE_AD_INFO(slave)); | ||
217 | |||
218 | @@ -1278,39 +1282,26 @@ static void bond_fill_ifslave(struct slave *slave, struct ifslave *info) | ||
219 | info->link_failure_count = slave->link_failure_count; | ||
220 | } | ||
221 | |||
222 | -static void bond_netdev_notify(struct net_device *dev, | ||
223 | - struct netdev_bonding_info *info) | ||
224 | -{ | ||
225 | - rtnl_lock(); | ||
226 | - netdev_bonding_info_change(dev, info); | ||
227 | - rtnl_unlock(); | ||
228 | -} | ||
229 | - | ||
230 | static void bond_netdev_notify_work(struct work_struct *_work) | ||
231 | { | ||
232 | - struct netdev_notify_work *w = | ||
233 | - container_of(_work, struct netdev_notify_work, work.work); | ||
234 | + struct slave *slave = container_of(_work, struct slave, | ||
235 | + notify_work.work); | ||
236 | + | ||
237 | + if (rtnl_trylock()) { | ||
238 | + struct netdev_bonding_info binfo; | ||
239 | |||
240 | - bond_netdev_notify(w->dev, &w->bonding_info); | ||
241 | - dev_put(w->dev); | ||
242 | - kfree(w); | ||
243 | + bond_fill_ifslave(slave, &binfo.slave); | ||
244 | + bond_fill_ifbond(slave->bond, &binfo.master); | ||
245 | + netdev_bonding_info_change(slave->dev, &binfo); | ||
246 | + rtnl_unlock(); | ||
247 | + } else { | ||
248 | + queue_delayed_work(slave->bond->wq, &slave->notify_work, 1); | ||
249 | + } | ||
250 | } | ||
251 | |||
252 | void bond_queue_slave_event(struct slave *slave) | ||
253 | { | ||
254 | - struct bonding *bond = slave->bond; | ||
255 | - struct netdev_notify_work *nnw = kzalloc(sizeof(*nnw), GFP_ATOMIC); | ||
256 | - | ||
257 | - if (!nnw) | ||
258 | - return; | ||
259 | - | ||
260 | - dev_hold(slave->dev); | ||
261 | - nnw->dev = slave->dev; | ||
262 | - bond_fill_ifslave(slave, &nnw->bonding_info.slave); | ||
263 | - bond_fill_ifbond(bond, &nnw->bonding_info.master); | ||
264 | - INIT_DELAYED_WORK(&nnw->work, bond_netdev_notify_work); | ||
265 | - | ||
266 | - queue_delayed_work(slave->bond->wq, &nnw->work, 0); | ||
267 | + queue_delayed_work(slave->bond->wq, &slave->notify_work, 0); | ||
268 | } | ||
269 | |||
270 | void bond_lower_state_changed(struct slave *slave) | ||
271 | diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c | ||
272 | index 2ce7ae97ac91..c2cd540e9c9e 100644 | ||
273 | --- a/drivers/net/dsa/bcm_sf2.c | ||
274 | +++ b/drivers/net/dsa/bcm_sf2.c | ||
275 | @@ -744,7 +744,6 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds) | ||
276 | static int bcm_sf2_sw_resume(struct dsa_switch *ds) | ||
277 | { | ||
278 | struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds); | ||
279 | - unsigned int port; | ||
280 | int ret; | ||
281 | |||
282 | ret = bcm_sf2_sw_rst(priv); | ||
283 | @@ -756,12 +755,7 @@ static int bcm_sf2_sw_resume(struct dsa_switch *ds) | ||
284 | if (priv->hw_params.num_gphy == 1) | ||
285 | bcm_sf2_gphy_enable_set(ds, true); | ||
286 | |||
287 | - for (port = 0; port < DSA_MAX_PORTS; port++) { | ||
288 | - if ((1 << port) & ds->enabled_port_mask) | ||
289 | - bcm_sf2_port_setup(ds, port, NULL); | ||
290 | - else if (dsa_is_cpu_port(ds, port)) | ||
291 | - bcm_sf2_imp_setup(ds, port); | ||
292 | - } | ||
293 | + ds->ops->setup(ds); | ||
294 | |||
295 | return 0; | ||
296 | } | ||
297 | @@ -1135,10 +1129,10 @@ static int bcm_sf2_sw_remove(struct platform_device *pdev) | ||
298 | { | ||
299 | struct bcm_sf2_priv *priv = platform_get_drvdata(pdev); | ||
300 | |||
301 | - /* Disable all ports and interrupts */ | ||
302 | priv->wol_ports_mask = 0; | ||
303 | - bcm_sf2_sw_suspend(priv->dev->ds); | ||
304 | dsa_unregister_switch(priv->dev->ds); | ||
305 | + /* Disable all ports and interrupts */ | ||
306 | + bcm_sf2_sw_suspend(priv->dev->ds); | ||
307 | bcm_sf2_mdio_unregister(priv); | ||
308 | |||
309 | return 0; | ||
310 | diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c | ||
311 | index 91fbba58d033..16dc9ac7ecb6 100644 | ||
312 | --- a/drivers/net/ethernet/broadcom/bcmsysport.c | ||
313 | +++ b/drivers/net/ethernet/broadcom/bcmsysport.c | ||
314 | @@ -828,14 +828,22 @@ static void bcm_sysport_resume_from_wol(struct bcm_sysport_priv *priv) | ||
315 | { | ||
316 | u32 reg; | ||
317 | |||
318 | - /* Stop monitoring MPD interrupt */ | ||
319 | - intrl2_0_mask_set(priv, INTRL2_0_MPD); | ||
320 | - | ||
321 | /* Clear the MagicPacket detection logic */ | ||
322 | reg = umac_readl(priv, UMAC_MPD_CTRL); | ||
323 | reg &= ~MPD_EN; | ||
324 | umac_writel(priv, reg, UMAC_MPD_CTRL); | ||
325 | |||
326 | + reg = intrl2_0_readl(priv, INTRL2_CPU_STATUS); | ||
327 | + if (reg & INTRL2_0_MPD) | ||
328 | + netdev_info(priv->netdev, "Wake-on-LAN (MPD) interrupt!\n"); | ||
329 | + | ||
330 | + if (reg & INTRL2_0_BRCM_MATCH_TAG) { | ||
331 | + reg = rxchk_readl(priv, RXCHK_BRCM_TAG_MATCH_STATUS) & | ||
332 | + RXCHK_BRCM_TAG_MATCH_MASK; | ||
333 | + netdev_info(priv->netdev, | ||
334 | + "Wake-on-LAN (filters 0x%02x) interrupt!\n", reg); | ||
335 | + } | ||
336 | + | ||
337 | netif_dbg(priv, wol, priv->netdev, "resumed from WOL\n"); | ||
338 | } | ||
339 | |||
340 | @@ -868,11 +876,6 @@ static irqreturn_t bcm_sysport_rx_isr(int irq, void *dev_id) | ||
341 | if (priv->irq0_stat & INTRL2_0_TX_RING_FULL) | ||
342 | bcm_sysport_tx_reclaim_all(priv); | ||
343 | |||
344 | - if (priv->irq0_stat & INTRL2_0_MPD) { | ||
345 | - netdev_info(priv->netdev, "Wake-on-LAN interrupt!\n"); | ||
346 | - bcm_sysport_resume_from_wol(priv); | ||
347 | - } | ||
348 | - | ||
349 | return IRQ_HANDLED; | ||
350 | } | ||
351 | |||
352 | @@ -1901,9 +1904,6 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) | ||
353 | /* UniMAC receive needs to be turned on */ | ||
354 | umac_enable_set(priv, CMD_RX_EN, 1); | ||
355 | |||
356 | - /* Enable the interrupt wake-up source */ | ||
357 | - intrl2_0_mask_clear(priv, INTRL2_0_MPD); | ||
358 | - | ||
359 | netif_dbg(priv, wol, ndev, "entered WOL mode\n"); | ||
360 | |||
361 | return 0; | ||
362 | diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
363 | index 72297b76944f..208e9dacfd34 100644 | ||
364 | --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
365 | +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | ||
366 | @@ -1666,8 +1666,11 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) | ||
367 | if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { | ||
368 | tx_pkts++; | ||
369 | /* return full budget so NAPI will complete. */ | ||
370 | - if (unlikely(tx_pkts > bp->tx_wake_thresh)) | ||
371 | + if (unlikely(tx_pkts > bp->tx_wake_thresh)) { | ||
372 | rx_pkts = budget; | ||
373 | + raw_cons = NEXT_RAW_CMP(raw_cons); | ||
374 | + break; | ||
375 | + } | ||
376 | } else if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { | ||
377 | rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &agg_event); | ||
378 | if (likely(rc >= 0)) | ||
379 | @@ -1685,7 +1688,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget) | ||
380 | } | ||
381 | raw_cons = NEXT_RAW_CMP(raw_cons); | ||
382 | |||
383 | - if (rx_pkts == budget) | ||
384 | + if (rx_pkts && rx_pkts == budget) | ||
385 | break; | ||
386 | } | ||
387 | |||
388 | @@ -1797,8 +1800,12 @@ static int bnxt_poll(struct napi_struct *napi, int budget) | ||
389 | while (1) { | ||
390 | work_done += bnxt_poll_work(bp, bnapi, budget - work_done); | ||
391 | |||
392 | - if (work_done >= budget) | ||
393 | + if (work_done >= budget) { | ||
394 | + if (!budget) | ||
395 | + BNXT_CP_DB_REARM(cpr->cp_doorbell, | ||
396 | + cpr->cp_raw_cons); | ||
397 | break; | ||
398 | + } | ||
399 | |||
400 | if (!bnxt_has_work(bp, cpr)) { | ||
401 | napi_complete(napi); | ||
402 | diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c | ||
403 | index 2e1585635083..8f55c23e9821 100644 | ||
404 | --- a/drivers/net/ethernet/cadence/macb.c | ||
405 | +++ b/drivers/net/ethernet/cadence/macb.c | ||
406 | @@ -2861,6 +2861,13 @@ static const struct macb_config at91sam9260_config = { | ||
407 | .init = macb_init, | ||
408 | }; | ||
409 | |||
410 | +static const struct macb_config sama5d3macb_config = { | ||
411 | + .caps = MACB_CAPS_SG_DISABLED | ||
412 | + | MACB_CAPS_USRIO_HAS_CLKEN | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII, | ||
413 | + .clk_init = macb_clk_init, | ||
414 | + .init = macb_init, | ||
415 | +}; | ||
416 | + | ||
417 | static const struct macb_config pc302gem_config = { | ||
418 | .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE, | ||
419 | .dma_burst_length = 16, | ||
420 | @@ -2925,6 +2932,7 @@ static const struct of_device_id macb_dt_ids[] = { | ||
421 | { .compatible = "cdns,gem", .data = &pc302gem_config }, | ||
422 | { .compatible = "atmel,sama5d2-gem", .data = &sama5d2_config }, | ||
423 | { .compatible = "atmel,sama5d3-gem", .data = &sama5d3_config }, | ||
424 | + { .compatible = "atmel,sama5d3-macb", .data = &sama5d3macb_config }, | ||
425 | { .compatible = "atmel,sama5d4-gem", .data = &sama5d4_config }, | ||
426 | { .compatible = "cdns,at91rm9200-emac", .data = &emac_config }, | ||
427 | { .compatible = "cdns,emac", .data = &emac_config }, | ||
428 | diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c | ||
429 | index b6ed818f78ff..06bc8638501e 100644 | ||
430 | --- a/drivers/net/ethernet/hisilicon/hns/hnae.c | ||
431 | +++ b/drivers/net/ethernet/hisilicon/hns/hnae.c | ||
432 | @@ -80,7 +80,7 @@ static void hnae_unmap_buffer(struct hnae_ring *ring, struct hnae_desc_cb *cb) | ||
433 | if (cb->type == DESC_TYPE_SKB) | ||
434 | dma_unmap_single(ring_to_dev(ring), cb->dma, cb->length, | ||
435 | ring_to_dma_dir(ring)); | ||
436 | - else | ||
437 | + else if (cb->length) | ||
438 | dma_unmap_page(ring_to_dev(ring), cb->dma, cb->length, | ||
439 | ring_to_dma_dir(ring)); | ||
440 | } | ||
441 | diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c | ||
442 | index 8a2a07e21324..92ed6534ceae 100644 | ||
443 | --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c | ||
444 | +++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c | ||
445 | @@ -39,9 +39,9 @@ | ||
446 | #define SKB_TMP_LEN(SKB) \ | ||
447 | (((SKB)->transport_header - (SKB)->mac_header) + tcp_hdrlen(SKB)) | ||
448 | |||
449 | -static void fill_v2_desc(struct hnae_ring *ring, void *priv, | ||
450 | - int size, dma_addr_t dma, int frag_end, | ||
451 | - int buf_num, enum hns_desc_type type, int mtu) | ||
452 | +static void fill_v2_desc_hw(struct hnae_ring *ring, void *priv, int size, | ||
453 | + int send_sz, dma_addr_t dma, int frag_end, | ||
454 | + int buf_num, enum hns_desc_type type, int mtu) | ||
455 | { | ||
456 | struct hnae_desc *desc = &ring->desc[ring->next_to_use]; | ||
457 | struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use]; | ||
458 | @@ -63,7 +63,7 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv, | ||
459 | desc_cb->type = type; | ||
460 | |||
461 | desc->addr = cpu_to_le64(dma); | ||
462 | - desc->tx.send_size = cpu_to_le16((u16)size); | ||
463 | + desc->tx.send_size = cpu_to_le16((u16)send_sz); | ||
464 | |||
465 | /* config bd buffer end */ | ||
466 | hnae_set_bit(rrcfv, HNSV2_TXD_VLD_B, 1); | ||
467 | @@ -132,6 +132,14 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv, | ||
468 | ring_ptr_move_fw(ring, next_to_use); | ||
469 | } | ||
470 | |||
471 | +static void fill_v2_desc(struct hnae_ring *ring, void *priv, | ||
472 | + int size, dma_addr_t dma, int frag_end, | ||
473 | + int buf_num, enum hns_desc_type type, int mtu) | ||
474 | +{ | ||
475 | + fill_v2_desc_hw(ring, priv, size, size, dma, frag_end, | ||
476 | + buf_num, type, mtu); | ||
477 | +} | ||
478 | + | ||
479 | static const struct acpi_device_id hns_enet_acpi_match[] = { | ||
480 | { "HISI00C1", 0 }, | ||
481 | { "HISI00C2", 0 }, | ||
482 | @@ -288,15 +296,15 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv, | ||
483 | |||
484 | /* when the frag size is bigger than hardware, split this frag */ | ||
485 | for (k = 0; k < frag_buf_num; k++) | ||
486 | - fill_v2_desc(ring, priv, | ||
487 | - (k == frag_buf_num - 1) ? | ||
488 | + fill_v2_desc_hw(ring, priv, k == 0 ? size : 0, | ||
489 | + (k == frag_buf_num - 1) ? | ||
490 | sizeoflast : BD_MAX_SEND_SIZE, | ||
491 | - dma + BD_MAX_SEND_SIZE * k, | ||
492 | - frag_end && (k == frag_buf_num - 1) ? 1 : 0, | ||
493 | - buf_num, | ||
494 | - (type == DESC_TYPE_SKB && !k) ? | ||
495 | + dma + BD_MAX_SEND_SIZE * k, | ||
496 | + frag_end && (k == frag_buf_num - 1) ? 1 : 0, | ||
497 | + buf_num, | ||
498 | + (type == DESC_TYPE_SKB && !k) ? | ||
499 | DESC_TYPE_SKB : DESC_TYPE_PAGE, | ||
500 | - mtu); | ||
501 | + mtu); | ||
502 | } | ||
503 | |||
504 | netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev, | ||
505 | diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c | ||
506 | index 7e2ebfc565ee..ff62dc7485d5 100644 | ||
507 | --- a/drivers/net/ethernet/marvell/mvpp2.c | ||
508 | +++ b/drivers/net/ethernet/marvell/mvpp2.c | ||
509 | @@ -29,6 +29,7 @@ | ||
510 | #include <linux/clk.h> | ||
511 | #include <linux/hrtimer.h> | ||
512 | #include <linux/ktime.h> | ||
513 | +#include <linux/if_vlan.h> | ||
514 | #include <uapi/linux/ppp_defs.h> | ||
515 | #include <net/ip.h> | ||
516 | #include <net/ipv6.h> | ||
517 | @@ -4266,7 +4267,7 @@ static void mvpp2_txq_desc_put(struct mvpp2_tx_queue *txq) | ||
518 | } | ||
519 | |||
520 | /* Set Tx descriptors fields relevant for CSUM calculation */ | ||
521 | -static u32 mvpp2_txq_desc_csum(int l3_offs, int l3_proto, | ||
522 | +static u32 mvpp2_txq_desc_csum(int l3_offs, __be16 l3_proto, | ||
523 | int ip_hdr_len, int l4_proto) | ||
524 | { | ||
525 | u32 command; | ||
526 | @@ -5019,14 +5020,15 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) | ||
527 | if (skb->ip_summed == CHECKSUM_PARTIAL) { | ||
528 | int ip_hdr_len = 0; | ||
529 | u8 l4_proto; | ||
530 | + __be16 l3_proto = vlan_get_protocol(skb); | ||
531 | |||
532 | - if (skb->protocol == htons(ETH_P_IP)) { | ||
533 | + if (l3_proto == htons(ETH_P_IP)) { | ||
534 | struct iphdr *ip4h = ip_hdr(skb); | ||
535 | |||
536 | /* Calculate IPv4 checksum and L4 checksum */ | ||
537 | ip_hdr_len = ip4h->ihl; | ||
538 | l4_proto = ip4h->protocol; | ||
539 | - } else if (skb->protocol == htons(ETH_P_IPV6)) { | ||
540 | + } else if (l3_proto == htons(ETH_P_IPV6)) { | ||
541 | struct ipv6hdr *ip6h = ipv6_hdr(skb); | ||
542 | |||
543 | /* Read l4_protocol from one of IPv6 extra headers */ | ||
544 | @@ -5038,7 +5040,7 @@ static u32 mvpp2_skb_tx_csum(struct mvpp2_port *port, struct sk_buff *skb) | ||
545 | } | ||
546 | |||
547 | return mvpp2_txq_desc_csum(skb_network_offset(skb), | ||
548 | - skb->protocol, ip_hdr_len, l4_proto); | ||
549 | + l3_proto, ip_hdr_len, l4_proto); | ||
550 | } | ||
551 | |||
552 | return MVPP2_TXD_L4_CSUM_NOT | MVPP2_TXD_IP_CSUM_DISABLE; | ||
553 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | ||
554 | index 49bad00a0f8f..5ddadcd0c8db 100644 | ||
555 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | ||
556 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | ||
557 | @@ -1800,7 +1800,8 @@ struct qlcnic_hardware_ops { | ||
558 | int (*config_loopback) (struct qlcnic_adapter *, u8); | ||
559 | int (*clear_loopback) (struct qlcnic_adapter *, u8); | ||
560 | int (*config_promisc_mode) (struct qlcnic_adapter *, u32); | ||
561 | - void (*change_l2_filter) (struct qlcnic_adapter *, u64 *, u16); | ||
562 | + void (*change_l2_filter)(struct qlcnic_adapter *adapter, u64 *addr, | ||
563 | + u16 vlan, struct qlcnic_host_tx_ring *tx_ring); | ||
564 | int (*get_board_info) (struct qlcnic_adapter *); | ||
565 | void (*set_mac_filter_count) (struct qlcnic_adapter *); | ||
566 | void (*free_mac_list) (struct qlcnic_adapter *); | ||
567 | @@ -2042,9 +2043,10 @@ static inline int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, | ||
568 | } | ||
569 | |||
570 | static inline void qlcnic_change_filter(struct qlcnic_adapter *adapter, | ||
571 | - u64 *addr, u16 id) | ||
572 | + u64 *addr, u16 vlan, | ||
573 | + struct qlcnic_host_tx_ring *tx_ring) | ||
574 | { | ||
575 | - adapter->ahw->hw_ops->change_l2_filter(adapter, addr, id); | ||
576 | + adapter->ahw->hw_ops->change_l2_filter(adapter, addr, vlan, tx_ring); | ||
577 | } | ||
578 | |||
579 | static inline int qlcnic_get_board_info(struct qlcnic_adapter *adapter) | ||
580 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | ||
581 | index c3c28f0960e5..05d32e86bcf7 100644 | ||
582 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | ||
583 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | ||
584 | @@ -2132,7 +2132,8 @@ out: | ||
585 | } | ||
586 | |||
587 | void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, | ||
588 | - u16 vlan_id) | ||
589 | + u16 vlan_id, | ||
590 | + struct qlcnic_host_tx_ring *tx_ring) | ||
591 | { | ||
592 | u8 mac[ETH_ALEN]; | ||
593 | memcpy(&mac, addr, ETH_ALEN); | ||
594 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h | ||
595 | index 331ae2c20f40..c8e012b3f7e7 100644 | ||
596 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h | ||
597 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h | ||
598 | @@ -550,7 +550,8 @@ int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32); | ||
599 | int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32); | ||
600 | int qlcnic_83xx_config_hw_lro(struct qlcnic_adapter *, int); | ||
601 | int qlcnic_83xx_config_rss(struct qlcnic_adapter *, int); | ||
602 | -void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *, u64 *, u16); | ||
603 | +void qlcnic_83xx_change_l2_filter(struct qlcnic_adapter *adapter, u64 *addr, | ||
604 | + u16 vlan, struct qlcnic_host_tx_ring *ring); | ||
605 | int qlcnic_83xx_get_pci_info(struct qlcnic_adapter *, struct qlcnic_pci_info *); | ||
606 | int qlcnic_83xx_set_nic_info(struct qlcnic_adapter *, struct qlcnic_info *); | ||
607 | void qlcnic_83xx_initialize_nic(struct qlcnic_adapter *, int); | ||
608 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h | ||
609 | index 4bb33af8e2b3..56a3bd9e37dc 100644 | ||
610 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h | ||
611 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h | ||
612 | @@ -173,7 +173,8 @@ int qlcnic_82xx_napi_add(struct qlcnic_adapter *adapter, | ||
613 | struct net_device *netdev); | ||
614 | void qlcnic_82xx_get_beacon_state(struct qlcnic_adapter *); | ||
615 | void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, | ||
616 | - u64 *uaddr, u16 vlan_id); | ||
617 | + u64 *uaddr, u16 vlan_id, | ||
618 | + struct qlcnic_host_tx_ring *tx_ring); | ||
619 | int qlcnic_82xx_config_intr_coalesce(struct qlcnic_adapter *, | ||
620 | struct ethtool_coalesce *); | ||
621 | int qlcnic_82xx_set_rx_coalesce(struct qlcnic_adapter *); | ||
622 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ||
623 | index fedd7366713c..e36129401b71 100644 | ||
624 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ||
625 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | ||
626 | @@ -268,13 +268,12 @@ static void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, | ||
627 | } | ||
628 | |||
629 | void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, | ||
630 | - u16 vlan_id) | ||
631 | + u16 vlan_id, struct qlcnic_host_tx_ring *tx_ring) | ||
632 | { | ||
633 | struct cmd_desc_type0 *hwdesc; | ||
634 | struct qlcnic_nic_req *req; | ||
635 | struct qlcnic_mac_req *mac_req; | ||
636 | struct qlcnic_vlan_req *vlan_req; | ||
637 | - struct qlcnic_host_tx_ring *tx_ring = adapter->tx_ring; | ||
638 | u32 producer; | ||
639 | u64 word; | ||
640 | |||
641 | @@ -301,7 +300,8 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr, | ||
642 | |||
643 | static void qlcnic_send_filter(struct qlcnic_adapter *adapter, | ||
644 | struct cmd_desc_type0 *first_desc, | ||
645 | - struct sk_buff *skb) | ||
646 | + struct sk_buff *skb, | ||
647 | + struct qlcnic_host_tx_ring *tx_ring) | ||
648 | { | ||
649 | struct vlan_ethhdr *vh = (struct vlan_ethhdr *)(skb->data); | ||
650 | struct ethhdr *phdr = (struct ethhdr *)(skb->data); | ||
651 | @@ -335,7 +335,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, | ||
652 | tmp_fil->vlan_id == vlan_id) { | ||
653 | if (jiffies > (QLCNIC_READD_AGE * HZ + tmp_fil->ftime)) | ||
654 | qlcnic_change_filter(adapter, &src_addr, | ||
655 | - vlan_id); | ||
656 | + vlan_id, tx_ring); | ||
657 | tmp_fil->ftime = jiffies; | ||
658 | return; | ||
659 | } | ||
660 | @@ -350,7 +350,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, | ||
661 | if (!fil) | ||
662 | return; | ||
663 | |||
664 | - qlcnic_change_filter(adapter, &src_addr, vlan_id); | ||
665 | + qlcnic_change_filter(adapter, &src_addr, vlan_id, tx_ring); | ||
666 | fil->ftime = jiffies; | ||
667 | fil->vlan_id = vlan_id; | ||
668 | memcpy(fil->faddr, &src_addr, ETH_ALEN); | ||
669 | @@ -766,7 +766,7 @@ netdev_tx_t qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) | ||
670 | } | ||
671 | |||
672 | if (adapter->drv_mac_learn) | ||
673 | - qlcnic_send_filter(adapter, first_desc, skb); | ||
674 | + qlcnic_send_filter(adapter, first_desc, skb, tx_ring); | ||
675 | |||
676 | tx_ring->tx_stats.tx_bytes += skb->len; | ||
677 | tx_ring->tx_stats.xmit_called++; | ||
678 | diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | ||
679 | index 890e4b083f4f..2019e163e0e9 100644 | ||
680 | --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | ||
681 | +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | ||
682 | @@ -71,7 +71,7 @@ static int dwmac1000_validate_mcast_bins(int mcast_bins) | ||
683 | * Description: | ||
684 | * This function validates the number of Unicast address entries supported | ||
685 | * by a particular Synopsys 10/100/1000 controller. The Synopsys controller | ||
686 | - * supports 1, 32, 64, or 128 Unicast filter entries for it's Unicast filter | ||
687 | + * supports 1..32, 64, or 128 Unicast filter entries for it's Unicast filter | ||
688 | * logic. This function validates a valid, supported configuration is | ||
689 | * selected, and defaults to 1 Unicast address if an unsupported | ||
690 | * configuration is selected. | ||
691 | @@ -81,8 +81,7 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries) | ||
692 | int x = ucast_entries; | ||
693 | |||
694 | switch (x) { | ||
695 | - case 1: | ||
696 | - case 32: | ||
697 | + case 1 ... 32: | ||
698 | case 64: | ||
699 | case 128: | ||
700 | break; | ||
701 | diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c | ||
702 | index f9ec00981b1e..9670aa23ffb9 100644 | ||
703 | --- a/drivers/net/team/team.c | ||
704 | +++ b/drivers/net/team/team.c | ||
705 | @@ -1171,6 +1171,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev) | ||
706 | return -EBUSY; | ||
707 | } | ||
708 | |||
709 | + if (dev == port_dev) { | ||
710 | + netdev_err(dev, "Cannot enslave team device to itself\n"); | ||
711 | + return -EINVAL; | ||
712 | + } | ||
713 | + | ||
714 | if (port_dev->features & NETIF_F_VLAN_CHALLENGED && | ||
715 | vlan_uses_dev(dev)) { | ||
716 | netdev_err(dev, "Device %s is VLAN challenged and team device has VLAN set up\n", | ||
717 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c | ||
718 | index 0d4440f28f6b..2b728cc52e3a 100644 | ||
719 | --- a/drivers/net/usb/qmi_wwan.c | ||
720 | +++ b/drivers/net/usb/qmi_wwan.c | ||
721 | @@ -934,6 +934,7 @@ static const struct usb_device_id products[] = { | ||
722 | {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ | ||
723 | {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ | ||
724 | {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ | ||
725 | + {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */ | ||
726 | {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */ | ||
727 | {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)}, /* Cinterion PHxx,PXxx (2 RmNet) */ | ||
728 | {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)}, /* Cinterion PHxx,PXxx (1 RmNet + USB Audio)*/ | ||
729 | diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c | ||
730 | index 03d04011d653..8d3f938c6a51 100644 | ||
731 | --- a/drivers/net/usb/smsc75xx.c | ||
732 | +++ b/drivers/net/usb/smsc75xx.c | ||
733 | @@ -1518,6 +1518,7 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) | ||
734 | { | ||
735 | struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); | ||
736 | if (pdata) { | ||
737 | + cancel_work_sync(&pdata->set_multicast); | ||
738 | netif_dbg(dev, ifdown, dev->net, "free pdata\n"); | ||
739 | kfree(pdata); | ||
740 | pdata = NULL; | ||
741 | diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h | ||
742 | index 0824a8164a24..07ea4fcf4f88 100644 | ||
743 | --- a/drivers/scsi/qla2xxx/qla_target.h | ||
744 | +++ b/drivers/scsi/qla2xxx/qla_target.h | ||
745 | @@ -440,8 +440,8 @@ struct atio_from_isp { | ||
746 | static inline int fcpcmd_is_corrupted(struct atio *atio) | ||
747 | { | ||
748 | if (atio->entry_type == ATIO_TYPE7 && | ||
749 | - (le16_to_cpu(atio->attr_n_length & FCP_CMD_LENGTH_MASK) < | ||
750 | - FCP_CMD_LENGTH_MIN)) | ||
751 | + ((le16_to_cpu(atio->attr_n_length) & FCP_CMD_LENGTH_MASK) < | ||
752 | + FCP_CMD_LENGTH_MIN)) | ||
753 | return 1; | ||
754 | else | ||
755 | return 0; | ||
756 | diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c | ||
757 | index 04d2b6e25503..80205f3362d4 100644 | ||
758 | --- a/drivers/target/iscsi/iscsi_target.c | ||
759 | +++ b/drivers/target/iscsi/iscsi_target.c | ||
760 | @@ -1435,7 +1435,8 @@ static void iscsit_do_crypto_hash_buf( | ||
761 | |||
762 | sg_init_table(sg, ARRAY_SIZE(sg)); | ||
763 | sg_set_buf(sg, buf, payload_length); | ||
764 | - sg_set_buf(sg + 1, pad_bytes, padding); | ||
765 | + if (padding) | ||
766 | + sg_set_buf(sg + 1, pad_bytes, padding); | ||
767 | |||
768 | ahash_request_set_crypt(hash, sg, data_crc, payload_length + padding); | ||
769 | |||
770 | @@ -3949,10 +3950,14 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn) | ||
771 | static void iscsit_get_rx_pdu(struct iscsi_conn *conn) | ||
772 | { | ||
773 | int ret; | ||
774 | - u8 buffer[ISCSI_HDR_LEN], opcode; | ||
775 | + u8 *buffer, opcode; | ||
776 | u32 checksum = 0, digest = 0; | ||
777 | struct kvec iov; | ||
778 | |||
779 | + buffer = kcalloc(ISCSI_HDR_LEN, sizeof(*buffer), GFP_KERNEL); | ||
780 | + if (!buffer) | ||
781 | + return; | ||
782 | + | ||
783 | while (!kthread_should_stop()) { | ||
784 | /* | ||
785 | * Ensure that both TX and RX per connection kthreads | ||
786 | @@ -3960,7 +3965,6 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) | ||
787 | */ | ||
788 | iscsit_thread_check_cpumask(conn, current, 0); | ||
789 | |||
790 | - memset(buffer, 0, ISCSI_HDR_LEN); | ||
791 | memset(&iov, 0, sizeof(struct kvec)); | ||
792 | |||
793 | iov.iov_base = buffer; | ||
794 | @@ -3969,7 +3973,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) | ||
795 | ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN); | ||
796 | if (ret != ISCSI_HDR_LEN) { | ||
797 | iscsit_rx_thread_wait_for_tcp(conn); | ||
798 | - return; | ||
799 | + break; | ||
800 | } | ||
801 | |||
802 | if (conn->conn_ops->HeaderDigest) { | ||
803 | @@ -3979,7 +3983,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) | ||
804 | ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN); | ||
805 | if (ret != ISCSI_CRC_LEN) { | ||
806 | iscsit_rx_thread_wait_for_tcp(conn); | ||
807 | - return; | ||
808 | + break; | ||
809 | } | ||
810 | |||
811 | iscsit_do_crypto_hash_buf(conn->conn_rx_hash, | ||
812 | @@ -4003,7 +4007,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) | ||
813 | } | ||
814 | |||
815 | if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) | ||
816 | - return; | ||
817 | + break; | ||
818 | |||
819 | opcode = buffer[0] & ISCSI_OPCODE_MASK; | ||
820 | |||
821 | @@ -4014,13 +4018,15 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *conn) | ||
822 | " while in Discovery Session, rejecting.\n", opcode); | ||
823 | iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR, | ||
824 | buffer); | ||
825 | - return; | ||
826 | + break; | ||
827 | } | ||
828 | |||
829 | ret = iscsi_target_rx_opcode(conn, buffer); | ||
830 | if (ret < 0) | ||
831 | - return; | ||
832 | + break; | ||
833 | } | ||
834 | + | ||
835 | + kfree(buffer); | ||
836 | } | ||
837 | |||
838 | int iscsi_target_rx_thread(void *arg) | ||
839 | diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c | ||
840 | index 0722f75f1d6a..45a03eff4db1 100644 | ||
841 | --- a/drivers/usb/host/xhci-hub.c | ||
842 | +++ b/drivers/usb/host/xhci-hub.c | ||
843 | @@ -1072,17 +1072,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, | ||
844 | temp = readl(port_array[wIndex]); | ||
845 | break; | ||
846 | } | ||
847 | - | ||
848 | - /* Software should not attempt to set | ||
849 | - * port link state above '3' (U3) and the port | ||
850 | - * must be enabled. | ||
851 | - */ | ||
852 | - if ((temp & PORT_PE) == 0 || | ||
853 | - (link_state > USB_SS_PORT_LS_U3)) { | ||
854 | - xhci_warn(xhci, "Cannot set link state.\n"); | ||
855 | + /* Port must be enabled */ | ||
856 | + if (!(temp & PORT_PE)) { | ||
857 | + retval = -ENODEV; | ||
858 | + break; | ||
859 | + } | ||
860 | + /* Can't set port link state above '3' (U3) */ | ||
861 | + if (link_state > USB_SS_PORT_LS_U3) { | ||
862 | + xhci_warn(xhci, "Cannot set port %d link state %d\n", | ||
863 | + wIndex, link_state); | ||
864 | goto error; | ||
865 | } | ||
866 | - | ||
867 | if (link_state == USB_SS_PORT_LS_U3) { | ||
868 | slot_id = xhci_find_slot_id_by_port(hcd, xhci, | ||
869 | wIndex + 1); | ||
870 | diff --git a/drivers/video/fbdev/aty/atyfb.h b/drivers/video/fbdev/aty/atyfb.h | ||
871 | index 63c4842eb224..46e0e8b39b76 100644 | ||
872 | --- a/drivers/video/fbdev/aty/atyfb.h | ||
873 | +++ b/drivers/video/fbdev/aty/atyfb.h | ||
874 | @@ -332,6 +332,8 @@ extern const struct aty_pll_ops aty_pll_ct; /* Integrated */ | ||
875 | extern void aty_set_pll_ct(const struct fb_info *info, const union aty_pll *pll); | ||
876 | extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); | ||
877 | |||
878 | +extern const u8 aty_postdividers[8]; | ||
879 | + | ||
880 | |||
881 | /* | ||
882 | * Hardware cursor support | ||
883 | @@ -358,7 +360,6 @@ static inline void wait_for_idle(struct atyfb_par *par) | ||
884 | |||
885 | extern void aty_reset_engine(const struct atyfb_par *par); | ||
886 | extern void aty_init_engine(struct atyfb_par *par, struct fb_info *info); | ||
887 | -extern u8 aty_ld_pll_ct(int offset, const struct atyfb_par *par); | ||
888 | |||
889 | void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area); | ||
890 | void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect); | ||
891 | diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c | ||
892 | index 81367cf0af77..da748c39196c 100644 | ||
893 | --- a/drivers/video/fbdev/aty/atyfb_base.c | ||
894 | +++ b/drivers/video/fbdev/aty/atyfb_base.c | ||
895 | @@ -3093,17 +3093,18 @@ static int atyfb_setup_sparc(struct pci_dev *pdev, struct fb_info *info, | ||
896 | /* | ||
897 | * PLL Reference Divider M: | ||
898 | */ | ||
899 | - M = pll_regs[2]; | ||
900 | + M = pll_regs[PLL_REF_DIV]; | ||
901 | |||
902 | /* | ||
903 | * PLL Feedback Divider N (Dependent on CLOCK_CNTL): | ||
904 | */ | ||
905 | - N = pll_regs[7 + (clock_cntl & 3)]; | ||
906 | + N = pll_regs[VCLK0_FB_DIV + (clock_cntl & 3)]; | ||
907 | |||
908 | /* | ||
909 | * PLL Post Divider P (Dependent on CLOCK_CNTL): | ||
910 | */ | ||
911 | - P = 1 << (pll_regs[6] >> ((clock_cntl & 3) << 1)); | ||
912 | + P = aty_postdividers[((pll_regs[VCLK_POST_DIV] >> ((clock_cntl & 3) << 1)) & 3) | | ||
913 | + ((pll_regs[PLL_EXT_CNTL] >> (2 + (clock_cntl & 3))) & 4)]; | ||
914 | |||
915 | /* | ||
916 | * PLL Divider Q: | ||
917 | diff --git a/drivers/video/fbdev/aty/mach64_ct.c b/drivers/video/fbdev/aty/mach64_ct.c | ||
918 | index 51f29d627ceb..af54256a20a1 100644 | ||
919 | --- a/drivers/video/fbdev/aty/mach64_ct.c | ||
920 | +++ b/drivers/video/fbdev/aty/mach64_ct.c | ||
921 | @@ -114,7 +114,7 @@ static void aty_st_pll_ct(int offset, u8 val, const struct atyfb_par *par) | ||
922 | */ | ||
923 | |||
924 | #define Maximum_DSP_PRECISION 7 | ||
925 | -static u8 postdividers[] = {1,2,4,8,3}; | ||
926 | +const u8 aty_postdividers[8] = {1,2,4,8,3,5,6,12}; | ||
927 | |||
928 | static int aty_dsp_gt(const struct fb_info *info, u32 bpp, struct pll_ct *pll) | ||
929 | { | ||
930 | @@ -221,7 +221,7 @@ static int aty_valid_pll_ct(const struct fb_info *info, u32 vclk_per, struct pll | ||
931 | pll->vclk_post_div += (q < 64*8); | ||
932 | pll->vclk_post_div += (q < 32*8); | ||
933 | } | ||
934 | - pll->vclk_post_div_real = postdividers[pll->vclk_post_div]; | ||
935 | + pll->vclk_post_div_real = aty_postdividers[pll->vclk_post_div]; | ||
936 | // pll->vclk_post_div <<= 6; | ||
937 | pll->vclk_fb_div = q * pll->vclk_post_div_real / 8; | ||
938 | pllvclk = (1000000 * 2 * pll->vclk_fb_div) / | ||
939 | @@ -512,7 +512,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) | ||
940 | u8 mclk_fb_div, pll_ext_cntl; | ||
941 | pll->ct.pll_ref_div = aty_ld_pll_ct(PLL_REF_DIV, par); | ||
942 | pll_ext_cntl = aty_ld_pll_ct(PLL_EXT_CNTL, par); | ||
943 | - pll->ct.xclk_post_div_real = postdividers[pll_ext_cntl & 0x07]; | ||
944 | + pll->ct.xclk_post_div_real = aty_postdividers[pll_ext_cntl & 0x07]; | ||
945 | mclk_fb_div = aty_ld_pll_ct(MCLK_FB_DIV, par); | ||
946 | if (pll_ext_cntl & PLL_MFB_TIMES_4_2B) | ||
947 | mclk_fb_div <<= 1; | ||
948 | @@ -534,7 +534,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) | ||
949 | xpost_div += (q < 64*8); | ||
950 | xpost_div += (q < 32*8); | ||
951 | } | ||
952 | - pll->ct.xclk_post_div_real = postdividers[xpost_div]; | ||
953 | + pll->ct.xclk_post_div_real = aty_postdividers[xpost_div]; | ||
954 | pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8; | ||
955 | |||
956 | #ifdef CONFIG_PPC | ||
957 | @@ -583,7 +583,7 @@ static int aty_init_pll_ct(const struct fb_info *info, union aty_pll *pll) | ||
958 | mpost_div += (q < 64*8); | ||
959 | mpost_div += (q < 32*8); | ||
960 | } | ||
961 | - sclk_post_div_real = postdividers[mpost_div]; | ||
962 | + sclk_post_div_real = aty_postdividers[mpost_div]; | ||
963 | pll->ct.sclk_fb_div = q * sclk_post_div_real / 8; | ||
964 | pll->ct.spll_cntl2 = mpost_div << 4; | ||
965 | #ifdef DEBUG | ||
966 | diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c | ||
967 | index c10180d0b018..7d6da09e637b 100644 | ||
968 | --- a/fs/ext4/xattr.c | ||
969 | +++ b/fs/ext4/xattr.c | ||
970 | @@ -657,7 +657,7 @@ ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s, | ||
971 | next = EXT4_XATTR_NEXT(last); | ||
972 | if ((void *)next >= s->end) { | ||
973 | EXT4_ERROR_INODE(inode, "corrupted xattr entries"); | ||
974 | - return -EIO; | ||
975 | + return -EFSCORRUPTED; | ||
976 | } | ||
977 | if (last->e_value_size) { | ||
978 | size_t offs = le16_to_cpu(last->e_value_offs); | ||
979 | diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h | ||
980 | index 47c7f5b8f675..f254982e1a8f 100644 | ||
981 | --- a/include/linux/netdevice.h | ||
982 | +++ b/include/linux/netdevice.h | ||
983 | @@ -2338,6 +2338,13 @@ struct netdev_notifier_info { | ||
984 | struct net_device *dev; | ||
985 | }; | ||
986 | |||
987 | +struct netdev_notifier_info_ext { | ||
988 | + struct netdev_notifier_info info; /* must be first */ | ||
989 | + union { | ||
990 | + u32 mtu; | ||
991 | + } ext; | ||
992 | +}; | ||
993 | + | ||
994 | struct netdev_notifier_change_info { | ||
995 | struct netdev_notifier_info info; /* must be first */ | ||
996 | unsigned int flags_changed; | ||
997 | diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h | ||
998 | index 85d1ffc90285..4421e5ccb092 100644 | ||
999 | --- a/include/linux/rhashtable.h | ||
1000 | +++ b/include/linux/rhashtable.h | ||
1001 | @@ -138,7 +138,6 @@ struct rhashtable_params { | ||
1002 | /** | ||
1003 | * struct rhashtable - Hash table handle | ||
1004 | * @tbl: Bucket table | ||
1005 | - * @nelems: Number of elements in table | ||
1006 | * @key_len: Key length for hashfn | ||
1007 | * @elasticity: Maximum chain length before rehash | ||
1008 | * @p: Configuration parameters | ||
1009 | @@ -146,10 +145,10 @@ struct rhashtable_params { | ||
1010 | * @run_work: Deferred worker to expand/shrink asynchronously | ||
1011 | * @mutex: Mutex to protect current/future table swapping | ||
1012 | * @lock: Spin lock to protect walker list | ||
1013 | + * @nelems: Number of elements in table | ||
1014 | */ | ||
1015 | struct rhashtable { | ||
1016 | struct bucket_table __rcu *tbl; | ||
1017 | - atomic_t nelems; | ||
1018 | unsigned int key_len; | ||
1019 | unsigned int elasticity; | ||
1020 | struct rhashtable_params p; | ||
1021 | @@ -157,6 +156,7 @@ struct rhashtable { | ||
1022 | struct work_struct run_work; | ||
1023 | struct mutex mutex; | ||
1024 | spinlock_t lock; | ||
1025 | + atomic_t nelems; | ||
1026 | }; | ||
1027 | |||
1028 | /** | ||
1029 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h | ||
1030 | index 1f207dd22757..e90fe6b83e00 100644 | ||
1031 | --- a/include/linux/skbuff.h | ||
1032 | +++ b/include/linux/skbuff.h | ||
1033 | @@ -643,9 +643,14 @@ struct sk_buff { | ||
1034 | struct skb_mstamp skb_mstamp; | ||
1035 | }; | ||
1036 | }; | ||
1037 | - struct rb_node rbnode; /* used in netem & tcp stack */ | ||
1038 | + struct rb_node rbnode; /* used in netem, ip4 defrag, and tcp stack */ | ||
1039 | }; | ||
1040 | - struct sock *sk; | ||
1041 | + | ||
1042 | + union { | ||
1043 | + struct sock *sk; | ||
1044 | + int ip_defrag_offset; | ||
1045 | + }; | ||
1046 | + | ||
1047 | struct net_device *dev; | ||
1048 | |||
1049 | /* | ||
1050 | @@ -2413,7 +2418,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list) | ||
1051 | kfree_skb(skb); | ||
1052 | } | ||
1053 | |||
1054 | -void skb_rbtree_purge(struct rb_root *root); | ||
1055 | +unsigned int skb_rbtree_purge(struct rb_root *root); | ||
1056 | |||
1057 | void *netdev_alloc_frag(unsigned int fragsz); | ||
1058 | |||
1059 | @@ -2949,6 +2954,7 @@ static inline unsigned char *skb_push_rcsum(struct sk_buff *skb, | ||
1060 | return skb->data; | ||
1061 | } | ||
1062 | |||
1063 | +int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len); | ||
1064 | /** | ||
1065 | * pskb_trim_rcsum - trim received skb and update checksum | ||
1066 | * @skb: buffer to trim | ||
1067 | @@ -2962,9 +2968,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) | ||
1068 | { | ||
1069 | if (likely(len >= skb->len)) | ||
1070 | return 0; | ||
1071 | - if (skb->ip_summed == CHECKSUM_COMPLETE) | ||
1072 | - skb->ip_summed = CHECKSUM_NONE; | ||
1073 | - return __pskb_trim(skb, len); | ||
1074 | + return pskb_trim_rcsum_slow(skb, len); | ||
1075 | } | ||
1076 | |||
1077 | static inline int __skb_trim_rcsum(struct sk_buff *skb, unsigned int len) | ||
1078 | @@ -2984,6 +2988,12 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) | ||
1079 | |||
1080 | #define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) | ||
1081 | |||
1082 | +#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) | ||
1083 | +#define skb_rb_first(root) rb_to_skb(rb_first(root)) | ||
1084 | +#define skb_rb_last(root) rb_to_skb(rb_last(root)) | ||
1085 | +#define skb_rb_next(skb) rb_to_skb(rb_next(&(skb)->rbnode)) | ||
1086 | +#define skb_rb_prev(skb) rb_to_skb(rb_prev(&(skb)->rbnode)) | ||
1087 | + | ||
1088 | #define skb_queue_walk(queue, skb) \ | ||
1089 | for (skb = (queue)->next; \ | ||
1090 | skb != (struct sk_buff *)(queue); \ | ||
1091 | @@ -2998,6 +3008,18 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) | ||
1092 | for (; skb != (struct sk_buff *)(queue); \ | ||
1093 | skb = skb->next) | ||
1094 | |||
1095 | +#define skb_rbtree_walk(skb, root) \ | ||
1096 | + for (skb = skb_rb_first(root); skb != NULL; \ | ||
1097 | + skb = skb_rb_next(skb)) | ||
1098 | + | ||
1099 | +#define skb_rbtree_walk_from(skb) \ | ||
1100 | + for (; skb != NULL; \ | ||
1101 | + skb = skb_rb_next(skb)) | ||
1102 | + | ||
1103 | +#define skb_rbtree_walk_from_safe(skb, tmp) \ | ||
1104 | + for (; tmp = skb ? skb_rb_next(skb) : NULL, (skb != NULL); \ | ||
1105 | + skb = tmp) | ||
1106 | + | ||
1107 | #define skb_queue_walk_from_safe(queue, skb, tmp) \ | ||
1108 | for (tmp = skb->next; \ | ||
1109 | skb != (struct sk_buff *)(queue); \ | ||
1110 | diff --git a/include/net/bonding.h b/include/net/bonding.h | ||
1111 | index 714428c54c68..8750c2c4871a 100644 | ||
1112 | --- a/include/net/bonding.h | ||
1113 | +++ b/include/net/bonding.h | ||
1114 | @@ -139,12 +139,6 @@ struct bond_parm_tbl { | ||
1115 | int mode; | ||
1116 | }; | ||
1117 | |||
1118 | -struct netdev_notify_work { | ||
1119 | - struct delayed_work work; | ||
1120 | - struct net_device *dev; | ||
1121 | - struct netdev_bonding_info bonding_info; | ||
1122 | -}; | ||
1123 | - | ||
1124 | struct slave { | ||
1125 | struct net_device *dev; /* first - useful for panic debug */ | ||
1126 | struct bonding *bond; /* our master */ | ||
1127 | @@ -171,6 +165,7 @@ struct slave { | ||
1128 | #ifdef CONFIG_NET_POLL_CONTROLLER | ||
1129 | struct netpoll *np; | ||
1130 | #endif | ||
1131 | + struct delayed_work notify_work; | ||
1132 | struct kobject kobj; | ||
1133 | struct rtnl_link_stats64 slave_stats; | ||
1134 | }; | ||
1135 | diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h | ||
1136 | index 634d19203e7d..a3812e9c8fee 100644 | ||
1137 | --- a/include/net/inet_frag.h | ||
1138 | +++ b/include/net/inet_frag.h | ||
1139 | @@ -1,14 +1,20 @@ | ||
1140 | #ifndef __NET_FRAG_H__ | ||
1141 | #define __NET_FRAG_H__ | ||
1142 | |||
1143 | +#include <linux/rhashtable.h> | ||
1144 | + | ||
1145 | struct netns_frags { | ||
1146 | - /* Keep atomic mem on separate cachelines in structs that include it */ | ||
1147 | - atomic_t mem ____cacheline_aligned_in_smp; | ||
1148 | /* sysctls */ | ||
1149 | + long high_thresh; | ||
1150 | + long low_thresh; | ||
1151 | int timeout; | ||
1152 | - int high_thresh; | ||
1153 | - int low_thresh; | ||
1154 | int max_dist; | ||
1155 | + struct inet_frags *f; | ||
1156 | + | ||
1157 | + struct rhashtable rhashtable ____cacheline_aligned_in_smp; | ||
1158 | + | ||
1159 | + /* Keep atomic mem on separate cachelines in structs that include it */ | ||
1160 | + atomic_long_t mem ____cacheline_aligned_in_smp; | ||
1161 | }; | ||
1162 | |||
1163 | /** | ||
1164 | @@ -24,130 +30,115 @@ enum { | ||
1165 | INET_FRAG_COMPLETE = BIT(2), | ||
1166 | }; | ||
1167 | |||
1168 | +struct frag_v4_compare_key { | ||
1169 | + __be32 saddr; | ||
1170 | + __be32 daddr; | ||
1171 | + u32 user; | ||
1172 | + u32 vif; | ||
1173 | + __be16 id; | ||
1174 | + u16 protocol; | ||
1175 | +}; | ||
1176 | + | ||
1177 | +struct frag_v6_compare_key { | ||
1178 | + struct in6_addr saddr; | ||
1179 | + struct in6_addr daddr; | ||
1180 | + u32 user; | ||
1181 | + __be32 id; | ||
1182 | + u32 iif; | ||
1183 | +}; | ||
1184 | + | ||
1185 | /** | ||
1186 | * struct inet_frag_queue - fragment queue | ||
1187 | * | ||
1188 | - * @lock: spinlock protecting the queue | ||
1189 | + * @node: rhash node | ||
1190 | + * @key: keys identifying this frag. | ||
1191 | * @timer: queue expiration timer | ||
1192 | - * @list: hash bucket list | ||
1193 | + * @lock: spinlock protecting this frag | ||
1194 | * @refcnt: reference count of the queue | ||
1195 | * @fragments: received fragments head | ||
1196 | + * @rb_fragments: received fragments rb-tree root | ||
1197 | * @fragments_tail: received fragments tail | ||
1198 | + * @last_run_head: the head of the last "run". see ip_fragment.c | ||
1199 | * @stamp: timestamp of the last received fragment | ||
1200 | * @len: total length of the original datagram | ||
1201 | * @meat: length of received fragments so far | ||
1202 | * @flags: fragment queue flags | ||
1203 | * @max_size: maximum received fragment size | ||
1204 | * @net: namespace that this frag belongs to | ||
1205 | - * @list_evictor: list of queues to forcefully evict (e.g. due to low memory) | ||
1206 | + * @rcu: rcu head for freeing deferall | ||
1207 | */ | ||
1208 | struct inet_frag_queue { | ||
1209 | - spinlock_t lock; | ||
1210 | + struct rhash_head node; | ||
1211 | + union { | ||
1212 | + struct frag_v4_compare_key v4; | ||
1213 | + struct frag_v6_compare_key v6; | ||
1214 | + } key; | ||
1215 | struct timer_list timer; | ||
1216 | - struct hlist_node list; | ||
1217 | + spinlock_t lock; | ||
1218 | atomic_t refcnt; | ||
1219 | - struct sk_buff *fragments; | ||
1220 | + struct sk_buff *fragments; /* Used in IPv6. */ | ||
1221 | + struct rb_root rb_fragments; /* Used in IPv4. */ | ||
1222 | struct sk_buff *fragments_tail; | ||
1223 | + struct sk_buff *last_run_head; | ||
1224 | ktime_t stamp; | ||
1225 | int len; | ||
1226 | int meat; | ||
1227 | __u8 flags; | ||
1228 | u16 max_size; | ||
1229 | - struct netns_frags *net; | ||
1230 | - struct hlist_node list_evictor; | ||
1231 | -}; | ||
1232 | - | ||
1233 | -#define INETFRAGS_HASHSZ 1024 | ||
1234 | - | ||
1235 | -/* averaged: | ||
1236 | - * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ / | ||
1237 | - * rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or | ||
1238 | - * struct frag_queue)) | ||
1239 | - */ | ||
1240 | -#define INETFRAGS_MAXDEPTH 128 | ||
1241 | - | ||
1242 | -struct inet_frag_bucket { | ||
1243 | - struct hlist_head chain; | ||
1244 | - spinlock_t chain_lock; | ||
1245 | + struct netns_frags *net; | ||
1246 | + struct rcu_head rcu; | ||
1247 | }; | ||
1248 | |||
1249 | struct inet_frags { | ||
1250 | - struct inet_frag_bucket hash[INETFRAGS_HASHSZ]; | ||
1251 | - | ||
1252 | - struct work_struct frags_work; | ||
1253 | - unsigned int next_bucket; | ||
1254 | - unsigned long last_rebuild_jiffies; | ||
1255 | - bool rebuild; | ||
1256 | - | ||
1257 | - /* The first call to hashfn is responsible to initialize | ||
1258 | - * rnd. This is best done with net_get_random_once. | ||
1259 | - * | ||
1260 | - * rnd_seqlock is used to let hash insertion detect | ||
1261 | - * when it needs to re-lookup the hash chain to use. | ||
1262 | - */ | ||
1263 | - u32 rnd; | ||
1264 | - seqlock_t rnd_seqlock; | ||
1265 | int qsize; | ||
1266 | |||
1267 | - unsigned int (*hashfn)(const struct inet_frag_queue *); | ||
1268 | - bool (*match)(const struct inet_frag_queue *q, | ||
1269 | - const void *arg); | ||
1270 | void (*constructor)(struct inet_frag_queue *q, | ||
1271 | const void *arg); | ||
1272 | void (*destructor)(struct inet_frag_queue *); | ||
1273 | void (*frag_expire)(unsigned long data); | ||
1274 | struct kmem_cache *frags_cachep; | ||
1275 | const char *frags_cache_name; | ||
1276 | + struct rhashtable_params rhash_params; | ||
1277 | }; | ||
1278 | |||
1279 | int inet_frags_init(struct inet_frags *); | ||
1280 | void inet_frags_fini(struct inet_frags *); | ||
1281 | |||
1282 | -static inline void inet_frags_init_net(struct netns_frags *nf) | ||
1283 | +static inline int inet_frags_init_net(struct netns_frags *nf) | ||
1284 | { | ||
1285 | - atomic_set(&nf->mem, 0); | ||
1286 | + atomic_long_set(&nf->mem, 0); | ||
1287 | + return rhashtable_init(&nf->rhashtable, &nf->f->rhash_params); | ||
1288 | } | ||
1289 | -void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); | ||
1290 | +void inet_frags_exit_net(struct netns_frags *nf); | ||
1291 | |||
1292 | -void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); | ||
1293 | -void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f); | ||
1294 | -struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, | ||
1295 | - struct inet_frags *f, void *key, unsigned int hash); | ||
1296 | +void inet_frag_kill(struct inet_frag_queue *q); | ||
1297 | +void inet_frag_destroy(struct inet_frag_queue *q); | ||
1298 | +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key); | ||
1299 | |||
1300 | -void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, | ||
1301 | - const char *prefix); | ||
1302 | +/* Free all skbs in the queue; return the sum of their truesizes. */ | ||
1303 | +unsigned int inet_frag_rbtree_purge(struct rb_root *root); | ||
1304 | |||
1305 | -static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f) | ||
1306 | +static inline void inet_frag_put(struct inet_frag_queue *q) | ||
1307 | { | ||
1308 | if (atomic_dec_and_test(&q->refcnt)) | ||
1309 | - inet_frag_destroy(q, f); | ||
1310 | -} | ||
1311 | - | ||
1312 | -static inline bool inet_frag_evicting(struct inet_frag_queue *q) | ||
1313 | -{ | ||
1314 | - return !hlist_unhashed(&q->list_evictor); | ||
1315 | + inet_frag_destroy(q); | ||
1316 | } | ||
1317 | |||
1318 | /* Memory Tracking Functions. */ | ||
1319 | |||
1320 | -static inline int frag_mem_limit(struct netns_frags *nf) | ||
1321 | -{ | ||
1322 | - return atomic_read(&nf->mem); | ||
1323 | -} | ||
1324 | - | ||
1325 | -static inline void sub_frag_mem_limit(struct netns_frags *nf, int i) | ||
1326 | +static inline long frag_mem_limit(const struct netns_frags *nf) | ||
1327 | { | ||
1328 | - atomic_sub(i, &nf->mem); | ||
1329 | + return atomic_long_read(&nf->mem); | ||
1330 | } | ||
1331 | |||
1332 | -static inline void add_frag_mem_limit(struct netns_frags *nf, int i) | ||
1333 | +static inline void sub_frag_mem_limit(struct netns_frags *nf, long val) | ||
1334 | { | ||
1335 | - atomic_add(i, &nf->mem); | ||
1336 | + atomic_long_sub(val, &nf->mem); | ||
1337 | } | ||
1338 | |||
1339 | -static inline int sum_frag_mem_limit(struct netns_frags *nf) | ||
1340 | +static inline void add_frag_mem_limit(struct netns_frags *nf, long val) | ||
1341 | { | ||
1342 | - return atomic_read(&nf->mem); | ||
1343 | + atomic_long_add(val, &nf->mem); | ||
1344 | } | ||
1345 | |||
1346 | /* RFC 3168 support : | ||
1347 | diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h | ||
1348 | index 0464b207d0cf..6213a90a8cec 100644 | ||
1349 | --- a/include/net/inet_sock.h | ||
1350 | +++ b/include/net/inet_sock.h | ||
1351 | @@ -132,12 +132,6 @@ static inline int inet_request_bound_dev_if(const struct sock *sk, | ||
1352 | return sk->sk_bound_dev_if; | ||
1353 | } | ||
1354 | |||
1355 | -static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq) | ||
1356 | -{ | ||
1357 | - return rcu_dereference_check(ireq->ireq_opt, | ||
1358 | - atomic_read(&ireq->req.rsk_refcnt) > 0); | ||
1359 | -} | ||
1360 | - | ||
1361 | struct inet_cork { | ||
1362 | unsigned int flags; | ||
1363 | __be32 addr; | ||
1364 | diff --git a/include/net/ip.h b/include/net/ip.h | ||
1365 | index bc9b4deeb60e..8646da034851 100644 | ||
1366 | --- a/include/net/ip.h | ||
1367 | +++ b/include/net/ip.h | ||
1368 | @@ -548,7 +548,6 @@ static inline struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *s | ||
1369 | return skb; | ||
1370 | } | ||
1371 | #endif | ||
1372 | -int ip_frag_mem(struct net *net); | ||
1373 | |||
1374 | /* | ||
1375 | * Functions provided by ip_forward.c | ||
1376 | diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h | ||
1377 | index 978387d6c3e6..a6446d72c5d9 100644 | ||
1378 | --- a/include/net/ip_fib.h | ||
1379 | +++ b/include/net/ip_fib.h | ||
1380 | @@ -363,6 +363,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev); | ||
1381 | int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force); | ||
1382 | int fib_sync_down_addr(struct net_device *dev, __be32 local); | ||
1383 | int fib_sync_up(struct net_device *dev, unsigned int nh_flags); | ||
1384 | +void fib_sync_mtu(struct net_device *dev, u32 orig_mtu); | ||
1385 | |||
1386 | extern u32 fib_multipath_secret __read_mostly; | ||
1387 | |||
1388 | diff --git a/include/net/ipv6.h b/include/net/ipv6.h | ||
1389 | index 64b0e9df31c7..7cb100d25bb5 100644 | ||
1390 | --- a/include/net/ipv6.h | ||
1391 | +++ b/include/net/ipv6.h | ||
1392 | @@ -330,13 +330,6 @@ static inline bool ipv6_accept_ra(struct inet6_dev *idev) | ||
1393 | idev->cnf.accept_ra; | ||
1394 | } | ||
1395 | |||
1396 | -#if IS_ENABLED(CONFIG_IPV6) | ||
1397 | -static inline int ip6_frag_mem(struct net *net) | ||
1398 | -{ | ||
1399 | - return sum_frag_mem_limit(&net->ipv6.frags); | ||
1400 | -} | ||
1401 | -#endif | ||
1402 | - | ||
1403 | #define IPV6_FRAG_HIGH_THRESH (4 * 1024*1024) /* 4194304 */ | ||
1404 | #define IPV6_FRAG_LOW_THRESH (3 * 1024*1024) /* 3145728 */ | ||
1405 | #define IPV6_FRAG_TIMEOUT (60 * HZ) /* 60 seconds */ | ||
1406 | @@ -530,17 +523,8 @@ enum ip6_defrag_users { | ||
1407 | __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX, | ||
1408 | }; | ||
1409 | |||
1410 | -struct ip6_create_arg { | ||
1411 | - __be32 id; | ||
1412 | - u32 user; | ||
1413 | - const struct in6_addr *src; | ||
1414 | - const struct in6_addr *dst; | ||
1415 | - int iif; | ||
1416 | - u8 ecn; | ||
1417 | -}; | ||
1418 | - | ||
1419 | void ip6_frag_init(struct inet_frag_queue *q, const void *a); | ||
1420 | -bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); | ||
1421 | +extern const struct rhashtable_params ip6_rhash_params; | ||
1422 | |||
1423 | /* | ||
1424 | * Equivalent of ipv4 struct ip | ||
1425 | @@ -548,19 +532,13 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a); | ||
1426 | struct frag_queue { | ||
1427 | struct inet_frag_queue q; | ||
1428 | |||
1429 | - __be32 id; /* fragment id */ | ||
1430 | - u32 user; | ||
1431 | - struct in6_addr saddr; | ||
1432 | - struct in6_addr daddr; | ||
1433 | - | ||
1434 | int iif; | ||
1435 | unsigned int csum; | ||
1436 | __u16 nhoffset; | ||
1437 | u8 ecn; | ||
1438 | }; | ||
1439 | |||
1440 | -void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, | ||
1441 | - struct inet_frags *frags); | ||
1442 | +void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq); | ||
1443 | |||
1444 | static inline bool ipv6_addr_any(const struct in6_addr *a) | ||
1445 | { | ||
1446 | diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h | ||
1447 | index e7a31f830690..3442a26d36d9 100644 | ||
1448 | --- a/include/uapi/linux/snmp.h | ||
1449 | +++ b/include/uapi/linux/snmp.h | ||
1450 | @@ -55,6 +55,7 @@ enum | ||
1451 | IPSTATS_MIB_ECT1PKTS, /* InECT1Pkts */ | ||
1452 | IPSTATS_MIB_ECT0PKTS, /* InECT0Pkts */ | ||
1453 | IPSTATS_MIB_CEPKTS, /* InCEPkts */ | ||
1454 | + IPSTATS_MIB_REASM_OVERLAPS, /* ReasmOverlaps */ | ||
1455 | __IPSTATS_MIB_MAX | ||
1456 | }; | ||
1457 | |||
1458 | diff --git a/lib/rhashtable.c b/lib/rhashtable.c | ||
1459 | index 101dac085c62..fdffd6232365 100644 | ||
1460 | --- a/lib/rhashtable.c | ||
1461 | +++ b/lib/rhashtable.c | ||
1462 | @@ -251,8 +251,10 @@ static int rhashtable_rehash_table(struct rhashtable *ht) | ||
1463 | if (!new_tbl) | ||
1464 | return 0; | ||
1465 | |||
1466 | - for (old_hash = 0; old_hash < old_tbl->size; old_hash++) | ||
1467 | + for (old_hash = 0; old_hash < old_tbl->size; old_hash++) { | ||
1468 | rhashtable_rehash_chain(ht, old_hash); | ||
1469 | + cond_resched(); | ||
1470 | + } | ||
1471 | |||
1472 | /* Publish the new table pointer. */ | ||
1473 | rcu_assign_pointer(ht->tbl, new_tbl); | ||
1474 | @@ -993,6 +995,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht, | ||
1475 | for (i = 0; i < tbl->size; i++) { | ||
1476 | struct rhash_head *pos, *next; | ||
1477 | |||
1478 | + cond_resched(); | ||
1479 | for (pos = rht_dereference(tbl->buckets[i], ht), | ||
1480 | next = !rht_is_a_nulls(pos) ? | ||
1481 | rht_dereference(pos->next, ht) : NULL; | ||
1482 | diff --git a/mm/vmstat.c b/mm/vmstat.c | ||
1483 | index d31e801a467c..5e6a4d76659d 100644 | ||
1484 | --- a/mm/vmstat.c | ||
1485 | +++ b/mm/vmstat.c | ||
1486 | @@ -1089,7 +1089,6 @@ const char * const vmstat_text[] = { | ||
1487 | #ifdef CONFIG_DEBUG_VM_VMACACHE | ||
1488 | "vmacache_find_calls", | ||
1489 | "vmacache_find_hits", | ||
1490 | - "vmacache_full_flushes", | ||
1491 | #endif | ||
1492 | #endif /* CONFIG_VM_EVENTS_COUNTERS */ | ||
1493 | }; | ||
1494 | diff --git a/net/core/dev.c b/net/core/dev.c | ||
1495 | index b85e789044d5..15e3bb94156b 100644 | ||
1496 | --- a/net/core/dev.c | ||
1497 | +++ b/net/core/dev.c | ||
1498 | @@ -1664,6 +1664,28 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev) | ||
1499 | } | ||
1500 | EXPORT_SYMBOL(call_netdevice_notifiers); | ||
1501 | |||
1502 | +/** | ||
1503 | + * call_netdevice_notifiers_mtu - call all network notifier blocks | ||
1504 | + * @val: value passed unmodified to notifier function | ||
1505 | + * @dev: net_device pointer passed unmodified to notifier function | ||
1506 | + * @arg: additional u32 argument passed to the notifier function | ||
1507 | + * | ||
1508 | + * Call all network notifier blocks. Parameters and return value | ||
1509 | + * are as for raw_notifier_call_chain(). | ||
1510 | + */ | ||
1511 | +static int call_netdevice_notifiers_mtu(unsigned long val, | ||
1512 | + struct net_device *dev, u32 arg) | ||
1513 | +{ | ||
1514 | + struct netdev_notifier_info_ext info = { | ||
1515 | + .info.dev = dev, | ||
1516 | + .ext.mtu = arg, | ||
1517 | + }; | ||
1518 | + | ||
1519 | + BUILD_BUG_ON(offsetof(struct netdev_notifier_info_ext, info) != 0); | ||
1520 | + | ||
1521 | + return call_netdevice_notifiers_info(val, dev, &info.info); | ||
1522 | +} | ||
1523 | + | ||
1524 | #ifdef CONFIG_NET_INGRESS | ||
1525 | static struct static_key ingress_needed __read_mostly; | ||
1526 | |||
1527 | @@ -6589,14 +6611,16 @@ int dev_set_mtu(struct net_device *dev, int new_mtu) | ||
1528 | err = __dev_set_mtu(dev, new_mtu); | ||
1529 | |||
1530 | if (!err) { | ||
1531 | - err = call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); | ||
1532 | + err = call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, | ||
1533 | + orig_mtu); | ||
1534 | err = notifier_to_errno(err); | ||
1535 | if (err) { | ||
1536 | /* setting mtu back and notifying everyone again, | ||
1537 | * so that they have a chance to revert changes. | ||
1538 | */ | ||
1539 | __dev_set_mtu(dev, orig_mtu); | ||
1540 | - call_netdevice_notifiers(NETDEV_CHANGEMTU, dev); | ||
1541 | + call_netdevice_notifiers_mtu(NETDEV_CHANGEMTU, dev, | ||
1542 | + new_mtu); | ||
1543 | } | ||
1544 | } | ||
1545 | return err; | ||
1546 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c | ||
1547 | index 194e844e1021..189082dc288d 100644 | ||
1548 | --- a/net/core/rtnetlink.c | ||
1549 | +++ b/net/core/rtnetlink.c | ||
1550 | @@ -2368,6 +2368,12 @@ struct net_device *rtnl_create_link(struct net *net, | ||
1551 | else if (ops->get_num_rx_queues) | ||
1552 | num_rx_queues = ops->get_num_rx_queues(); | ||
1553 | |||
1554 | + if (num_tx_queues < 1 || num_tx_queues > 4096) | ||
1555 | + return ERR_PTR(-EINVAL); | ||
1556 | + | ||
1557 | + if (num_rx_queues < 1 || num_rx_queues > 4096) | ||
1558 | + return ERR_PTR(-EINVAL); | ||
1559 | + | ||
1560 | err = -ENOMEM; | ||
1561 | dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type, | ||
1562 | ops->setup, num_tx_queues, num_rx_queues); | ||
1563 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c | ||
1564 | index 84c731aef0d8..038ec74fa131 100644 | ||
1565 | --- a/net/core/skbuff.c | ||
1566 | +++ b/net/core/skbuff.c | ||
1567 | @@ -1578,6 +1578,20 @@ done: | ||
1568 | } | ||
1569 | EXPORT_SYMBOL(___pskb_trim); | ||
1570 | |||
1571 | +/* Note : use pskb_trim_rcsum() instead of calling this directly | ||
1572 | + */ | ||
1573 | +int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len) | ||
1574 | +{ | ||
1575 | + if (skb->ip_summed == CHECKSUM_COMPLETE) { | ||
1576 | + int delta = skb->len - len; | ||
1577 | + | ||
1578 | + skb->csum = csum_sub(skb->csum, | ||
1579 | + skb_checksum(skb, len, delta, 0)); | ||
1580 | + } | ||
1581 | + return __pskb_trim(skb, len); | ||
1582 | +} | ||
1583 | +EXPORT_SYMBOL(pskb_trim_rcsum_slow); | ||
1584 | + | ||
1585 | /** | ||
1586 | * __pskb_pull_tail - advance tail of skb header | ||
1587 | * @skb: buffer to reallocate | ||
1588 | @@ -2425,20 +2439,27 @@ EXPORT_SYMBOL(skb_queue_purge); | ||
1589 | /** | ||
1590 | * skb_rbtree_purge - empty a skb rbtree | ||
1591 | * @root: root of the rbtree to empty | ||
1592 | + * Return value: the sum of truesizes of all purged skbs. | ||
1593 | * | ||
1594 | * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from | ||
1595 | * the list and one reference dropped. This function does not take | ||
1596 | * any lock. Synchronization should be handled by the caller (e.g., TCP | ||
1597 | * out-of-order queue is protected by the socket lock). | ||
1598 | */ | ||
1599 | -void skb_rbtree_purge(struct rb_root *root) | ||
1600 | +unsigned int skb_rbtree_purge(struct rb_root *root) | ||
1601 | { | ||
1602 | - struct sk_buff *skb, *next; | ||
1603 | + struct rb_node *p = rb_first(root); | ||
1604 | + unsigned int sum = 0; | ||
1605 | |||
1606 | - rbtree_postorder_for_each_entry_safe(skb, next, root, rbnode) | ||
1607 | - kfree_skb(skb); | ||
1608 | + while (p) { | ||
1609 | + struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); | ||
1610 | |||
1611 | - *root = RB_ROOT; | ||
1612 | + p = rb_next(p); | ||
1613 | + rb_erase(&skb->rbnode, root); | ||
1614 | + sum += skb->truesize; | ||
1615 | + kfree_skb(skb); | ||
1616 | + } | ||
1617 | + return sum; | ||
1618 | } | ||
1619 | |||
1620 | /** | ||
1621 | diff --git a/net/dccp/input.c b/net/dccp/input.c | ||
1622 | index 4a05d7876850..84ff43acd427 100644 | ||
1623 | --- a/net/dccp/input.c | ||
1624 | +++ b/net/dccp/input.c | ||
1625 | @@ -605,11 +605,13 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, | ||
1626 | if (sk->sk_state == DCCP_LISTEN) { | ||
1627 | if (dh->dccph_type == DCCP_PKT_REQUEST) { | ||
1628 | /* It is possible that we process SYN packets from backlog, | ||
1629 | - * so we need to make sure to disable BH right there. | ||
1630 | + * so we need to make sure to disable BH and RCU right there. | ||
1631 | */ | ||
1632 | + rcu_read_lock(); | ||
1633 | local_bh_disable(); | ||
1634 | acceptable = inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) >= 0; | ||
1635 | local_bh_enable(); | ||
1636 | + rcu_read_unlock(); | ||
1637 | if (!acceptable) | ||
1638 | return 1; | ||
1639 | consume_skb(skb); | ||
1640 | diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c | ||
1641 | index 6697b180e122..28ad6f187e19 100644 | ||
1642 | --- a/net/dccp/ipv4.c | ||
1643 | +++ b/net/dccp/ipv4.c | ||
1644 | @@ -493,9 +493,11 @@ static int dccp_v4_send_response(const struct sock *sk, struct request_sock *req | ||
1645 | |||
1646 | dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->ir_loc_addr, | ||
1647 | ireq->ir_rmt_addr); | ||
1648 | + rcu_read_lock(); | ||
1649 | err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr, | ||
1650 | ireq->ir_rmt_addr, | ||
1651 | - ireq_opt_deref(ireq)); | ||
1652 | + rcu_dereference(ireq->ireq_opt)); | ||
1653 | + rcu_read_unlock(); | ||
1654 | err = net_xmit_eval(err); | ||
1655 | } | ||
1656 | |||
1657 | diff --git a/net/ieee802154/6lowpan/6lowpan_i.h b/net/ieee802154/6lowpan/6lowpan_i.h | ||
1658 | index 5ac778962e4e..3bfec472734a 100644 | ||
1659 | --- a/net/ieee802154/6lowpan/6lowpan_i.h | ||
1660 | +++ b/net/ieee802154/6lowpan/6lowpan_i.h | ||
1661 | @@ -16,37 +16,19 @@ typedef unsigned __bitwise__ lowpan_rx_result; | ||
1662 | #define LOWPAN_DISPATCH_FRAG1 0xc0 | ||
1663 | #define LOWPAN_DISPATCH_FRAGN 0xe0 | ||
1664 | |||
1665 | -struct lowpan_create_arg { | ||
1666 | +struct frag_lowpan_compare_key { | ||
1667 | u16 tag; | ||
1668 | u16 d_size; | ||
1669 | - const struct ieee802154_addr *src; | ||
1670 | - const struct ieee802154_addr *dst; | ||
1671 | + const struct ieee802154_addr src; | ||
1672 | + const struct ieee802154_addr dst; | ||
1673 | }; | ||
1674 | |||
1675 | -/* Equivalent of ipv4 struct ip | ||
1676 | +/* Equivalent of ipv4 struct ipq | ||
1677 | */ | ||
1678 | struct lowpan_frag_queue { | ||
1679 | struct inet_frag_queue q; | ||
1680 | - | ||
1681 | - u16 tag; | ||
1682 | - u16 d_size; | ||
1683 | - struct ieee802154_addr saddr; | ||
1684 | - struct ieee802154_addr daddr; | ||
1685 | }; | ||
1686 | |||
1687 | -static inline u32 ieee802154_addr_hash(const struct ieee802154_addr *a) | ||
1688 | -{ | ||
1689 | - switch (a->mode) { | ||
1690 | - case IEEE802154_ADDR_LONG: | ||
1691 | - return (((__force u64)a->extended_addr) >> 32) ^ | ||
1692 | - (((__force u64)a->extended_addr) & 0xffffffff); | ||
1693 | - case IEEE802154_ADDR_SHORT: | ||
1694 | - return (__force u32)(a->short_addr + (a->pan_id << 16)); | ||
1695 | - default: | ||
1696 | - return 0; | ||
1697 | - } | ||
1698 | -} | ||
1699 | - | ||
1700 | int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type); | ||
1701 | void lowpan_net_frag_exit(void); | ||
1702 | int lowpan_net_frag_init(void); | ||
1703 | diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c | ||
1704 | index f85b08baff16..6fca75581e13 100644 | ||
1705 | --- a/net/ieee802154/6lowpan/reassembly.c | ||
1706 | +++ b/net/ieee802154/6lowpan/reassembly.c | ||
1707 | @@ -37,47 +37,15 @@ static struct inet_frags lowpan_frags; | ||
1708 | static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, | ||
1709 | struct sk_buff *prev, struct net_device *ldev); | ||
1710 | |||
1711 | -static unsigned int lowpan_hash_frag(u16 tag, u16 d_size, | ||
1712 | - const struct ieee802154_addr *saddr, | ||
1713 | - const struct ieee802154_addr *daddr) | ||
1714 | -{ | ||
1715 | - net_get_random_once(&lowpan_frags.rnd, sizeof(lowpan_frags.rnd)); | ||
1716 | - return jhash_3words(ieee802154_addr_hash(saddr), | ||
1717 | - ieee802154_addr_hash(daddr), | ||
1718 | - (__force u32)(tag + (d_size << 16)), | ||
1719 | - lowpan_frags.rnd); | ||
1720 | -} | ||
1721 | - | ||
1722 | -static unsigned int lowpan_hashfn(const struct inet_frag_queue *q) | ||
1723 | -{ | ||
1724 | - const struct lowpan_frag_queue *fq; | ||
1725 | - | ||
1726 | - fq = container_of(q, struct lowpan_frag_queue, q); | ||
1727 | - return lowpan_hash_frag(fq->tag, fq->d_size, &fq->saddr, &fq->daddr); | ||
1728 | -} | ||
1729 | - | ||
1730 | -static bool lowpan_frag_match(const struct inet_frag_queue *q, const void *a) | ||
1731 | -{ | ||
1732 | - const struct lowpan_frag_queue *fq; | ||
1733 | - const struct lowpan_create_arg *arg = a; | ||
1734 | - | ||
1735 | - fq = container_of(q, struct lowpan_frag_queue, q); | ||
1736 | - return fq->tag == arg->tag && fq->d_size == arg->d_size && | ||
1737 | - ieee802154_addr_equal(&fq->saddr, arg->src) && | ||
1738 | - ieee802154_addr_equal(&fq->daddr, arg->dst); | ||
1739 | -} | ||
1740 | - | ||
1741 | static void lowpan_frag_init(struct inet_frag_queue *q, const void *a) | ||
1742 | { | ||
1743 | - const struct lowpan_create_arg *arg = a; | ||
1744 | + const struct frag_lowpan_compare_key *key = a; | ||
1745 | struct lowpan_frag_queue *fq; | ||
1746 | |||
1747 | fq = container_of(q, struct lowpan_frag_queue, q); | ||
1748 | |||
1749 | - fq->tag = arg->tag; | ||
1750 | - fq->d_size = arg->d_size; | ||
1751 | - fq->saddr = *arg->src; | ||
1752 | - fq->daddr = *arg->dst; | ||
1753 | + BUILD_BUG_ON(sizeof(*key) > sizeof(q->key)); | ||
1754 | + memcpy(&q->key, key, sizeof(*key)); | ||
1755 | } | ||
1756 | |||
1757 | static void lowpan_frag_expire(unsigned long data) | ||
1758 | @@ -93,10 +61,10 @@ static void lowpan_frag_expire(unsigned long data) | ||
1759 | if (fq->q.flags & INET_FRAG_COMPLETE) | ||
1760 | goto out; | ||
1761 | |||
1762 | - inet_frag_kill(&fq->q, &lowpan_frags); | ||
1763 | + inet_frag_kill(&fq->q); | ||
1764 | out: | ||
1765 | spin_unlock(&fq->q.lock); | ||
1766 | - inet_frag_put(&fq->q, &lowpan_frags); | ||
1767 | + inet_frag_put(&fq->q); | ||
1768 | } | ||
1769 | |||
1770 | static inline struct lowpan_frag_queue * | ||
1771 | @@ -104,25 +72,20 @@ fq_find(struct net *net, const struct lowpan_802154_cb *cb, | ||
1772 | const struct ieee802154_addr *src, | ||
1773 | const struct ieee802154_addr *dst) | ||
1774 | { | ||
1775 | - struct inet_frag_queue *q; | ||
1776 | - struct lowpan_create_arg arg; | ||
1777 | - unsigned int hash; | ||
1778 | struct netns_ieee802154_lowpan *ieee802154_lowpan = | ||
1779 | net_ieee802154_lowpan(net); | ||
1780 | + struct frag_lowpan_compare_key key = { | ||
1781 | + .tag = cb->d_tag, | ||
1782 | + .d_size = cb->d_size, | ||
1783 | + .src = *src, | ||
1784 | + .dst = *dst, | ||
1785 | + }; | ||
1786 | + struct inet_frag_queue *q; | ||
1787 | |||
1788 | - arg.tag = cb->d_tag; | ||
1789 | - arg.d_size = cb->d_size; | ||
1790 | - arg.src = src; | ||
1791 | - arg.dst = dst; | ||
1792 | - | ||
1793 | - hash = lowpan_hash_frag(cb->d_tag, cb->d_size, src, dst); | ||
1794 | - | ||
1795 | - q = inet_frag_find(&ieee802154_lowpan->frags, | ||
1796 | - &lowpan_frags, &arg, hash); | ||
1797 | - if (IS_ERR_OR_NULL(q)) { | ||
1798 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); | ||
1799 | + q = inet_frag_find(&ieee802154_lowpan->frags, &key); | ||
1800 | + if (!q) | ||
1801 | return NULL; | ||
1802 | - } | ||
1803 | + | ||
1804 | return container_of(q, struct lowpan_frag_queue, q); | ||
1805 | } | ||
1806 | |||
1807 | @@ -229,7 +192,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev, | ||
1808 | struct sk_buff *fp, *head = fq->q.fragments; | ||
1809 | int sum_truesize; | ||
1810 | |||
1811 | - inet_frag_kill(&fq->q, &lowpan_frags); | ||
1812 | + inet_frag_kill(&fq->q); | ||
1813 | |||
1814 | /* Make the one we just received the head. */ | ||
1815 | if (prev) { | ||
1816 | @@ -437,7 +400,7 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type) | ||
1817 | ret = lowpan_frag_queue(fq, skb, frag_type); | ||
1818 | spin_unlock(&fq->q.lock); | ||
1819 | |||
1820 | - inet_frag_put(&fq->q, &lowpan_frags); | ||
1821 | + inet_frag_put(&fq->q); | ||
1822 | return ret; | ||
1823 | } | ||
1824 | |||
1825 | @@ -447,24 +410,22 @@ err: | ||
1826 | } | ||
1827 | |||
1828 | #ifdef CONFIG_SYSCTL | ||
1829 | -static int zero; | ||
1830 | |||
1831 | static struct ctl_table lowpan_frags_ns_ctl_table[] = { | ||
1832 | { | ||
1833 | .procname = "6lowpanfrag_high_thresh", | ||
1834 | .data = &init_net.ieee802154_lowpan.frags.high_thresh, | ||
1835 | - .maxlen = sizeof(int), | ||
1836 | + .maxlen = sizeof(unsigned long), | ||
1837 | .mode = 0644, | ||
1838 | - .proc_handler = proc_dointvec_minmax, | ||
1839 | + .proc_handler = proc_doulongvec_minmax, | ||
1840 | .extra1 = &init_net.ieee802154_lowpan.frags.low_thresh | ||
1841 | }, | ||
1842 | { | ||
1843 | .procname = "6lowpanfrag_low_thresh", | ||
1844 | .data = &init_net.ieee802154_lowpan.frags.low_thresh, | ||
1845 | - .maxlen = sizeof(int), | ||
1846 | + .maxlen = sizeof(unsigned long), | ||
1847 | .mode = 0644, | ||
1848 | - .proc_handler = proc_dointvec_minmax, | ||
1849 | - .extra1 = &zero, | ||
1850 | + .proc_handler = proc_doulongvec_minmax, | ||
1851 | .extra2 = &init_net.ieee802154_lowpan.frags.high_thresh | ||
1852 | }, | ||
1853 | { | ||
1854 | @@ -580,14 +541,20 @@ static int __net_init lowpan_frags_init_net(struct net *net) | ||
1855 | { | ||
1856 | struct netns_ieee802154_lowpan *ieee802154_lowpan = | ||
1857 | net_ieee802154_lowpan(net); | ||
1858 | + int res; | ||
1859 | |||
1860 | ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; | ||
1861 | ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; | ||
1862 | ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; | ||
1863 | + ieee802154_lowpan->frags.f = &lowpan_frags; | ||
1864 | |||
1865 | - inet_frags_init_net(&ieee802154_lowpan->frags); | ||
1866 | - | ||
1867 | - return lowpan_frags_ns_sysctl_register(net); | ||
1868 | + res = inet_frags_init_net(&ieee802154_lowpan->frags); | ||
1869 | + if (res < 0) | ||
1870 | + return res; | ||
1871 | + res = lowpan_frags_ns_sysctl_register(net); | ||
1872 | + if (res < 0) | ||
1873 | + inet_frags_exit_net(&ieee802154_lowpan->frags); | ||
1874 | + return res; | ||
1875 | } | ||
1876 | |||
1877 | static void __net_exit lowpan_frags_exit_net(struct net *net) | ||
1878 | @@ -596,7 +563,7 @@ static void __net_exit lowpan_frags_exit_net(struct net *net) | ||
1879 | net_ieee802154_lowpan(net); | ||
1880 | |||
1881 | lowpan_frags_ns_sysctl_unregister(net); | ||
1882 | - inet_frags_exit_net(&ieee802154_lowpan->frags, &lowpan_frags); | ||
1883 | + inet_frags_exit_net(&ieee802154_lowpan->frags); | ||
1884 | } | ||
1885 | |||
1886 | static struct pernet_operations lowpan_frags_ops = { | ||
1887 | @@ -604,32 +571,63 @@ static struct pernet_operations lowpan_frags_ops = { | ||
1888 | .exit = lowpan_frags_exit_net, | ||
1889 | }; | ||
1890 | |||
1891 | -int __init lowpan_net_frag_init(void) | ||
1892 | +static u32 lowpan_key_hashfn(const void *data, u32 len, u32 seed) | ||
1893 | { | ||
1894 | - int ret; | ||
1895 | + return jhash2(data, | ||
1896 | + sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); | ||
1897 | +} | ||
1898 | |||
1899 | - ret = lowpan_frags_sysctl_register(); | ||
1900 | - if (ret) | ||
1901 | - return ret; | ||
1902 | +static u32 lowpan_obj_hashfn(const void *data, u32 len, u32 seed) | ||
1903 | +{ | ||
1904 | + const struct inet_frag_queue *fq = data; | ||
1905 | |||
1906 | - ret = register_pernet_subsys(&lowpan_frags_ops); | ||
1907 | - if (ret) | ||
1908 | - goto err_pernet; | ||
1909 | + return jhash2((const u32 *)&fq->key, | ||
1910 | + sizeof(struct frag_lowpan_compare_key) / sizeof(u32), seed); | ||
1911 | +} | ||
1912 | + | ||
1913 | +static int lowpan_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) | ||
1914 | +{ | ||
1915 | + const struct frag_lowpan_compare_key *key = arg->key; | ||
1916 | + const struct inet_frag_queue *fq = ptr; | ||
1917 | + | ||
1918 | + return !!memcmp(&fq->key, key, sizeof(*key)); | ||
1919 | +} | ||
1920 | + | ||
1921 | +static const struct rhashtable_params lowpan_rhash_params = { | ||
1922 | + .head_offset = offsetof(struct inet_frag_queue, node), | ||
1923 | + .hashfn = lowpan_key_hashfn, | ||
1924 | + .obj_hashfn = lowpan_obj_hashfn, | ||
1925 | + .obj_cmpfn = lowpan_obj_cmpfn, | ||
1926 | + .automatic_shrinking = true, | ||
1927 | +}; | ||
1928 | + | ||
1929 | +int __init lowpan_net_frag_init(void) | ||
1930 | +{ | ||
1931 | + int ret; | ||
1932 | |||
1933 | - lowpan_frags.hashfn = lowpan_hashfn; | ||
1934 | lowpan_frags.constructor = lowpan_frag_init; | ||
1935 | lowpan_frags.destructor = NULL; | ||
1936 | lowpan_frags.qsize = sizeof(struct frag_queue); | ||
1937 | - lowpan_frags.match = lowpan_frag_match; | ||
1938 | lowpan_frags.frag_expire = lowpan_frag_expire; | ||
1939 | lowpan_frags.frags_cache_name = lowpan_frags_cache_name; | ||
1940 | + lowpan_frags.rhash_params = lowpan_rhash_params; | ||
1941 | ret = inet_frags_init(&lowpan_frags); | ||
1942 | if (ret) | ||
1943 | - goto err_pernet; | ||
1944 | + goto out; | ||
1945 | |||
1946 | + ret = lowpan_frags_sysctl_register(); | ||
1947 | + if (ret) | ||
1948 | + goto err_sysctl; | ||
1949 | + | ||
1950 | + ret = register_pernet_subsys(&lowpan_frags_ops); | ||
1951 | + if (ret) | ||
1952 | + goto err_pernet; | ||
1953 | +out: | ||
1954 | return ret; | ||
1955 | err_pernet: | ||
1956 | lowpan_frags_sysctl_unregister(); | ||
1957 | +err_sysctl: | ||
1958 | + inet_frags_fini(&lowpan_frags); | ||
1959 | return ret; | ||
1960 | } | ||
1961 | |||
1962 | diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c | ||
1963 | index 6a2ef162088d..9364c39d0555 100644 | ||
1964 | --- a/net/ipv4/fib_frontend.c | ||
1965 | +++ b/net/ipv4/fib_frontend.c | ||
1966 | @@ -1171,7 +1171,8 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, | ||
1967 | static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) | ||
1968 | { | ||
1969 | struct net_device *dev = netdev_notifier_info_to_dev(ptr); | ||
1970 | - struct netdev_notifier_changeupper_info *info; | ||
1971 | + struct netdev_notifier_changeupper_info *upper_info = ptr; | ||
1972 | + struct netdev_notifier_info_ext *info_ext = ptr; | ||
1973 | struct in_device *in_dev; | ||
1974 | struct net *net = dev_net(dev); | ||
1975 | unsigned int flags; | ||
1976 | @@ -1206,16 +1207,19 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo | ||
1977 | fib_sync_up(dev, RTNH_F_LINKDOWN); | ||
1978 | else | ||
1979 | fib_sync_down_dev(dev, event, false); | ||
1980 | - /* fall through */ | ||
1981 | + rt_cache_flush(net); | ||
1982 | + break; | ||
1983 | case NETDEV_CHANGEMTU: | ||
1984 | + fib_sync_mtu(dev, info_ext->ext.mtu); | ||
1985 | rt_cache_flush(net); | ||
1986 | break; | ||
1987 | case NETDEV_CHANGEUPPER: | ||
1988 | - info = ptr; | ||
1989 | + upper_info = ptr; | ||
1990 | /* flush all routes if dev is linked to or unlinked from | ||
1991 | * an L3 master device (e.g., VRF) | ||
1992 | */ | ||
1993 | - if (info->upper_dev && netif_is_l3_master(info->upper_dev)) | ||
1994 | + if (upper_info->upper_dev && | ||
1995 | + netif_is_l3_master(upper_info->upper_dev)) | ||
1996 | fib_disable_ip(dev, NETDEV_DOWN, true); | ||
1997 | break; | ||
1998 | } | ||
1999 | diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c | ||
2000 | index a88dab33cdf6..90c654012510 100644 | ||
2001 | --- a/net/ipv4/fib_semantics.c | ||
2002 | +++ b/net/ipv4/fib_semantics.c | ||
2003 | @@ -1377,6 +1377,56 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local) | ||
2004 | return ret; | ||
2005 | } | ||
2006 | |||
2007 | +/* Update the PMTU of exceptions when: | ||
2008 | + * - the new MTU of the first hop becomes smaller than the PMTU | ||
2009 | + * - the old MTU was the same as the PMTU, and it limited discovery of | ||
2010 | + * larger MTUs on the path. With that limit raised, we can now | ||
2011 | + * discover larger MTUs | ||
2012 | + * A special case is locked exceptions, for which the PMTU is smaller | ||
2013 | + * than the minimal accepted PMTU: | ||
2014 | + * - if the new MTU is greater than the PMTU, don't make any change | ||
2015 | + * - otherwise, unlock and set PMTU | ||
2016 | + */ | ||
2017 | +static void nh_update_mtu(struct fib_nh *nh, u32 new, u32 orig) | ||
2018 | +{ | ||
2019 | + struct fnhe_hash_bucket *bucket; | ||
2020 | + int i; | ||
2021 | + | ||
2022 | + bucket = rcu_dereference_protected(nh->nh_exceptions, 1); | ||
2023 | + if (!bucket) | ||
2024 | + return; | ||
2025 | + | ||
2026 | + for (i = 0; i < FNHE_HASH_SIZE; i++) { | ||
2027 | + struct fib_nh_exception *fnhe; | ||
2028 | + | ||
2029 | + for (fnhe = rcu_dereference_protected(bucket[i].chain, 1); | ||
2030 | + fnhe; | ||
2031 | + fnhe = rcu_dereference_protected(fnhe->fnhe_next, 1)) { | ||
2032 | + if (fnhe->fnhe_mtu_locked) { | ||
2033 | + if (new <= fnhe->fnhe_pmtu) { | ||
2034 | + fnhe->fnhe_pmtu = new; | ||
2035 | + fnhe->fnhe_mtu_locked = false; | ||
2036 | + } | ||
2037 | + } else if (new < fnhe->fnhe_pmtu || | ||
2038 | + orig == fnhe->fnhe_pmtu) { | ||
2039 | + fnhe->fnhe_pmtu = new; | ||
2040 | + } | ||
2041 | + } | ||
2042 | + } | ||
2043 | +} | ||
2044 | + | ||
2045 | +void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) | ||
2046 | +{ | ||
2047 | + unsigned int hash = fib_devindex_hashfn(dev->ifindex); | ||
2048 | + struct hlist_head *head = &fib_info_devhash[hash]; | ||
2049 | + struct fib_nh *nh; | ||
2050 | + | ||
2051 | + hlist_for_each_entry(nh, head, nh_hash) { | ||
2052 | + if (nh->nh_dev == dev) | ||
2053 | + nh_update_mtu(nh, dev->mtu, orig_mtu); | ||
2054 | + } | ||
2055 | +} | ||
2056 | + | ||
2057 | /* Event force Flags Description | ||
2058 | * NETDEV_CHANGE 0 LINKDOWN Carrier OFF, not for scope host | ||
2059 | * NETDEV_DOWN 0 LINKDOWN|DEAD Link down, not for scope host | ||
2060 | diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c | ||
2061 | index d1cab49393e2..528a6777cda0 100644 | ||
2062 | --- a/net/ipv4/inet_connection_sock.c | ||
2063 | +++ b/net/ipv4/inet_connection_sock.c | ||
2064 | @@ -410,7 +410,8 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk, | ||
2065 | struct ip_options_rcu *opt; | ||
2066 | struct rtable *rt; | ||
2067 | |||
2068 | - opt = ireq_opt_deref(ireq); | ||
2069 | + rcu_read_lock(); | ||
2070 | + opt = rcu_dereference(ireq->ireq_opt); | ||
2071 | |||
2072 | flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark, | ||
2073 | RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, | ||
2074 | @@ -424,11 +425,13 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk, | ||
2075 | goto no_route; | ||
2076 | if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) | ||
2077 | goto route_err; | ||
2078 | + rcu_read_unlock(); | ||
2079 | return &rt->dst; | ||
2080 | |||
2081 | route_err: | ||
2082 | ip_rt_put(rt); | ||
2083 | no_route: | ||
2084 | + rcu_read_unlock(); | ||
2085 | __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES); | ||
2086 | return NULL; | ||
2087 | } | ||
2088 | diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c | ||
2089 | index f8b41aaac76f..8323d33c0ce2 100644 | ||
2090 | --- a/net/ipv4/inet_fragment.c | ||
2091 | +++ b/net/ipv4/inet_fragment.c | ||
2092 | @@ -25,12 +25,6 @@ | ||
2093 | #include <net/inet_frag.h> | ||
2094 | #include <net/inet_ecn.h> | ||
2095 | |||
2096 | -#define INETFRAGS_EVICT_BUCKETS 128 | ||
2097 | -#define INETFRAGS_EVICT_MAX 512 | ||
2098 | - | ||
2099 | -/* don't rebuild inetfrag table with new secret more often than this */ | ||
2100 | -#define INETFRAGS_MIN_REBUILD_INTERVAL (5 * HZ) | ||
2101 | - | ||
2102 | /* Given the OR values of all fragments, apply RFC 3168 5.3 requirements | ||
2103 | * Value : 0xff if frame should be dropped. | ||
2104 | * 0 or INET_ECN_CE value, to be ORed in to final iph->tos field | ||
2105 | @@ -52,157 +46,8 @@ const u8 ip_frag_ecn_table[16] = { | ||
2106 | }; | ||
2107 | EXPORT_SYMBOL(ip_frag_ecn_table); | ||
2108 | |||
2109 | -static unsigned int | ||
2110 | -inet_frag_hashfn(const struct inet_frags *f, const struct inet_frag_queue *q) | ||
2111 | -{ | ||
2112 | - return f->hashfn(q) & (INETFRAGS_HASHSZ - 1); | ||
2113 | -} | ||
2114 | - | ||
2115 | -static bool inet_frag_may_rebuild(struct inet_frags *f) | ||
2116 | -{ | ||
2117 | - return time_after(jiffies, | ||
2118 | - f->last_rebuild_jiffies + INETFRAGS_MIN_REBUILD_INTERVAL); | ||
2119 | -} | ||
2120 | - | ||
2121 | -static void inet_frag_secret_rebuild(struct inet_frags *f) | ||
2122 | -{ | ||
2123 | - int i; | ||
2124 | - | ||
2125 | - write_seqlock_bh(&f->rnd_seqlock); | ||
2126 | - | ||
2127 | - if (!inet_frag_may_rebuild(f)) | ||
2128 | - goto out; | ||
2129 | - | ||
2130 | - get_random_bytes(&f->rnd, sizeof(u32)); | ||
2131 | - | ||
2132 | - for (i = 0; i < INETFRAGS_HASHSZ; i++) { | ||
2133 | - struct inet_frag_bucket *hb; | ||
2134 | - struct inet_frag_queue *q; | ||
2135 | - struct hlist_node *n; | ||
2136 | - | ||
2137 | - hb = &f->hash[i]; | ||
2138 | - spin_lock(&hb->chain_lock); | ||
2139 | - | ||
2140 | - hlist_for_each_entry_safe(q, n, &hb->chain, list) { | ||
2141 | - unsigned int hval = inet_frag_hashfn(f, q); | ||
2142 | - | ||
2143 | - if (hval != i) { | ||
2144 | - struct inet_frag_bucket *hb_dest; | ||
2145 | - | ||
2146 | - hlist_del(&q->list); | ||
2147 | - | ||
2148 | - /* Relink to new hash chain. */ | ||
2149 | - hb_dest = &f->hash[hval]; | ||
2150 | - | ||
2151 | - /* This is the only place where we take | ||
2152 | - * another chain_lock while already holding | ||
2153 | - * one. As this will not run concurrently, | ||
2154 | - * we cannot deadlock on hb_dest lock below, if its | ||
2155 | - * already locked it will be released soon since | ||
2156 | - * other caller cannot be waiting for hb lock | ||
2157 | - * that we've taken above. | ||
2158 | - */ | ||
2159 | - spin_lock_nested(&hb_dest->chain_lock, | ||
2160 | - SINGLE_DEPTH_NESTING); | ||
2161 | - hlist_add_head(&q->list, &hb_dest->chain); | ||
2162 | - spin_unlock(&hb_dest->chain_lock); | ||
2163 | - } | ||
2164 | - } | ||
2165 | - spin_unlock(&hb->chain_lock); | ||
2166 | - } | ||
2167 | - | ||
2168 | - f->rebuild = false; | ||
2169 | - f->last_rebuild_jiffies = jiffies; | ||
2170 | -out: | ||
2171 | - write_sequnlock_bh(&f->rnd_seqlock); | ||
2172 | -} | ||
2173 | - | ||
2174 | -static bool inet_fragq_should_evict(const struct inet_frag_queue *q) | ||
2175 | -{ | ||
2176 | - if (!hlist_unhashed(&q->list_evictor)) | ||
2177 | - return false; | ||
2178 | - | ||
2179 | - return q->net->low_thresh == 0 || | ||
2180 | - frag_mem_limit(q->net) >= q->net->low_thresh; | ||
2181 | -} | ||
2182 | - | ||
2183 | -static unsigned int | ||
2184 | -inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb) | ||
2185 | -{ | ||
2186 | - struct inet_frag_queue *fq; | ||
2187 | - struct hlist_node *n; | ||
2188 | - unsigned int evicted = 0; | ||
2189 | - HLIST_HEAD(expired); | ||
2190 | - | ||
2191 | - spin_lock(&hb->chain_lock); | ||
2192 | - | ||
2193 | - hlist_for_each_entry_safe(fq, n, &hb->chain, list) { | ||
2194 | - if (!inet_fragq_should_evict(fq)) | ||
2195 | - continue; | ||
2196 | - | ||
2197 | - if (!del_timer(&fq->timer)) | ||
2198 | - continue; | ||
2199 | - | ||
2200 | - hlist_add_head(&fq->list_evictor, &expired); | ||
2201 | - ++evicted; | ||
2202 | - } | ||
2203 | - | ||
2204 | - spin_unlock(&hb->chain_lock); | ||
2205 | - | ||
2206 | - hlist_for_each_entry_safe(fq, n, &expired, list_evictor) | ||
2207 | - f->frag_expire((unsigned long) fq); | ||
2208 | - | ||
2209 | - return evicted; | ||
2210 | -} | ||
2211 | - | ||
2212 | -static void inet_frag_worker(struct work_struct *work) | ||
2213 | -{ | ||
2214 | - unsigned int budget = INETFRAGS_EVICT_BUCKETS; | ||
2215 | - unsigned int i, evicted = 0; | ||
2216 | - struct inet_frags *f; | ||
2217 | - | ||
2218 | - f = container_of(work, struct inet_frags, frags_work); | ||
2219 | - | ||
2220 | - BUILD_BUG_ON(INETFRAGS_EVICT_BUCKETS >= INETFRAGS_HASHSZ); | ||
2221 | - | ||
2222 | - local_bh_disable(); | ||
2223 | - | ||
2224 | - for (i = ACCESS_ONCE(f->next_bucket); budget; --budget) { | ||
2225 | - evicted += inet_evict_bucket(f, &f->hash[i]); | ||
2226 | - i = (i + 1) & (INETFRAGS_HASHSZ - 1); | ||
2227 | - if (evicted > INETFRAGS_EVICT_MAX) | ||
2228 | - break; | ||
2229 | - } | ||
2230 | - | ||
2231 | - f->next_bucket = i; | ||
2232 | - | ||
2233 | - local_bh_enable(); | ||
2234 | - | ||
2235 | - if (f->rebuild && inet_frag_may_rebuild(f)) | ||
2236 | - inet_frag_secret_rebuild(f); | ||
2237 | -} | ||
2238 | - | ||
2239 | -static void inet_frag_schedule_worker(struct inet_frags *f) | ||
2240 | -{ | ||
2241 | - if (unlikely(!work_pending(&f->frags_work))) | ||
2242 | - schedule_work(&f->frags_work); | ||
2243 | -} | ||
2244 | - | ||
2245 | int inet_frags_init(struct inet_frags *f) | ||
2246 | { | ||
2247 | - int i; | ||
2248 | - | ||
2249 | - INIT_WORK(&f->frags_work, inet_frag_worker); | ||
2250 | - | ||
2251 | - for (i = 0; i < INETFRAGS_HASHSZ; i++) { | ||
2252 | - struct inet_frag_bucket *hb = &f->hash[i]; | ||
2253 | - | ||
2254 | - spin_lock_init(&hb->chain_lock); | ||
2255 | - INIT_HLIST_HEAD(&hb->chain); | ||
2256 | - } | ||
2257 | - | ||
2258 | - seqlock_init(&f->rnd_seqlock); | ||
2259 | - f->last_rebuild_jiffies = 0; | ||
2260 | f->frags_cachep = kmem_cache_create(f->frags_cache_name, f->qsize, 0, 0, | ||
2261 | NULL); | ||
2262 | if (!f->frags_cachep) | ||
2263 | @@ -214,83 +59,75 @@ EXPORT_SYMBOL(inet_frags_init); | ||
2264 | |||
2265 | void inet_frags_fini(struct inet_frags *f) | ||
2266 | { | ||
2267 | - cancel_work_sync(&f->frags_work); | ||
2268 | + /* We must wait that all inet_frag_destroy_rcu() have completed. */ | ||
2269 | + rcu_barrier(); | ||
2270 | + | ||
2271 | kmem_cache_destroy(f->frags_cachep); | ||
2272 | + f->frags_cachep = NULL; | ||
2273 | } | ||
2274 | EXPORT_SYMBOL(inet_frags_fini); | ||
2275 | |||
2276 | -void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f) | ||
2277 | +static void inet_frags_free_cb(void *ptr, void *arg) | ||
2278 | { | ||
2279 | - unsigned int seq; | ||
2280 | - int i; | ||
2281 | - | ||
2282 | - nf->low_thresh = 0; | ||
2283 | - | ||
2284 | -evict_again: | ||
2285 | - local_bh_disable(); | ||
2286 | - seq = read_seqbegin(&f->rnd_seqlock); | ||
2287 | + struct inet_frag_queue *fq = ptr; | ||
2288 | |||
2289 | - for (i = 0; i < INETFRAGS_HASHSZ ; i++) | ||
2290 | - inet_evict_bucket(f, &f->hash[i]); | ||
2291 | - | ||
2292 | - local_bh_enable(); | ||
2293 | - cond_resched(); | ||
2294 | - | ||
2295 | - if (read_seqretry(&f->rnd_seqlock, seq) || | ||
2296 | - sum_frag_mem_limit(nf)) | ||
2297 | - goto evict_again; | ||
2298 | -} | ||
2299 | -EXPORT_SYMBOL(inet_frags_exit_net); | ||
2300 | - | ||
2301 | -static struct inet_frag_bucket * | ||
2302 | -get_frag_bucket_locked(struct inet_frag_queue *fq, struct inet_frags *f) | ||
2303 | -__acquires(hb->chain_lock) | ||
2304 | -{ | ||
2305 | - struct inet_frag_bucket *hb; | ||
2306 | - unsigned int seq, hash; | ||
2307 | - | ||
2308 | - restart: | ||
2309 | - seq = read_seqbegin(&f->rnd_seqlock); | ||
2310 | - | ||
2311 | - hash = inet_frag_hashfn(f, fq); | ||
2312 | - hb = &f->hash[hash]; | ||
2313 | + /* If we can not cancel the timer, it means this frag_queue | ||
2314 | + * is already disappearing, we have nothing to do. | ||
2315 | + * Otherwise, we own a refcount until the end of this function. | ||
2316 | + */ | ||
2317 | + if (!del_timer(&fq->timer)) | ||
2318 | + return; | ||
2319 | |||
2320 | - spin_lock(&hb->chain_lock); | ||
2321 | - if (read_seqretry(&f->rnd_seqlock, seq)) { | ||
2322 | - spin_unlock(&hb->chain_lock); | ||
2323 | - goto restart; | ||
2324 | + spin_lock_bh(&fq->lock); | ||
2325 | + if (!(fq->flags & INET_FRAG_COMPLETE)) { | ||
2326 | + fq->flags |= INET_FRAG_COMPLETE; | ||
2327 | + atomic_dec(&fq->refcnt); | ||
2328 | } | ||
2329 | + spin_unlock_bh(&fq->lock); | ||
2330 | |||
2331 | - return hb; | ||
2332 | + inet_frag_put(fq); | ||
2333 | } | ||
2334 | |||
2335 | -static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f) | ||
2336 | +void inet_frags_exit_net(struct netns_frags *nf) | ||
2337 | { | ||
2338 | - struct inet_frag_bucket *hb; | ||
2339 | + nf->low_thresh = 0; /* prevent creation of new frags */ | ||
2340 | |||
2341 | - hb = get_frag_bucket_locked(fq, f); | ||
2342 | - hlist_del(&fq->list); | ||
2343 | - fq->flags |= INET_FRAG_COMPLETE; | ||
2344 | - spin_unlock(&hb->chain_lock); | ||
2345 | + rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL); | ||
2346 | } | ||
2347 | +EXPORT_SYMBOL(inet_frags_exit_net); | ||
2348 | |||
2349 | -void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f) | ||
2350 | +void inet_frag_kill(struct inet_frag_queue *fq) | ||
2351 | { | ||
2352 | if (del_timer(&fq->timer)) | ||
2353 | atomic_dec(&fq->refcnt); | ||
2354 | |||
2355 | if (!(fq->flags & INET_FRAG_COMPLETE)) { | ||
2356 | - fq_unlink(fq, f); | ||
2357 | + struct netns_frags *nf = fq->net; | ||
2358 | + | ||
2359 | + fq->flags |= INET_FRAG_COMPLETE; | ||
2360 | + rhashtable_remove_fast(&nf->rhashtable, &fq->node, nf->f->rhash_params); | ||
2361 | atomic_dec(&fq->refcnt); | ||
2362 | } | ||
2363 | } | ||
2364 | EXPORT_SYMBOL(inet_frag_kill); | ||
2365 | |||
2366 | -void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) | ||
2367 | +static void inet_frag_destroy_rcu(struct rcu_head *head) | ||
2368 | +{ | ||
2369 | + struct inet_frag_queue *q = container_of(head, struct inet_frag_queue, | ||
2370 | + rcu); | ||
2371 | + struct inet_frags *f = q->net->f; | ||
2372 | + | ||
2373 | + if (f->destructor) | ||
2374 | + f->destructor(q); | ||
2375 | + kmem_cache_free(f->frags_cachep, q); | ||
2376 | +} | ||
2377 | + | ||
2378 | +void inet_frag_destroy(struct inet_frag_queue *q) | ||
2379 | { | ||
2380 | struct sk_buff *fp; | ||
2381 | struct netns_frags *nf; | ||
2382 | unsigned int sum, sum_truesize = 0; | ||
2383 | + struct inet_frags *f; | ||
2384 | |||
2385 | WARN_ON(!(q->flags & INET_FRAG_COMPLETE)); | ||
2386 | WARN_ON(del_timer(&q->timer) != 0); | ||
2387 | @@ -298,64 +135,35 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f) | ||
2388 | /* Release all fragment data. */ | ||
2389 | fp = q->fragments; | ||
2390 | nf = q->net; | ||
2391 | - while (fp) { | ||
2392 | - struct sk_buff *xp = fp->next; | ||
2393 | - | ||
2394 | - sum_truesize += fp->truesize; | ||
2395 | - kfree_skb(fp); | ||
2396 | - fp = xp; | ||
2397 | + f = nf->f; | ||
2398 | + if (fp) { | ||
2399 | + do { | ||
2400 | + struct sk_buff *xp = fp->next; | ||
2401 | + | ||
2402 | + sum_truesize += fp->truesize; | ||
2403 | + kfree_skb(fp); | ||
2404 | + fp = xp; | ||
2405 | + } while (fp); | ||
2406 | + } else { | ||
2407 | + sum_truesize = inet_frag_rbtree_purge(&q->rb_fragments); | ||
2408 | } | ||
2409 | sum = sum_truesize + f->qsize; | ||
2410 | |||
2411 | - if (f->destructor) | ||
2412 | - f->destructor(q); | ||
2413 | - kmem_cache_free(f->frags_cachep, q); | ||
2414 | + call_rcu(&q->rcu, inet_frag_destroy_rcu); | ||
2415 | |||
2416 | sub_frag_mem_limit(nf, sum); | ||
2417 | } | ||
2418 | EXPORT_SYMBOL(inet_frag_destroy); | ||
2419 | |||
2420 | -static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf, | ||
2421 | - struct inet_frag_queue *qp_in, | ||
2422 | - struct inet_frags *f, | ||
2423 | - void *arg) | ||
2424 | -{ | ||
2425 | - struct inet_frag_bucket *hb = get_frag_bucket_locked(qp_in, f); | ||
2426 | - struct inet_frag_queue *qp; | ||
2427 | - | ||
2428 | -#ifdef CONFIG_SMP | ||
2429 | - /* With SMP race we have to recheck hash table, because | ||
2430 | - * such entry could have been created on other cpu before | ||
2431 | - * we acquired hash bucket lock. | ||
2432 | - */ | ||
2433 | - hlist_for_each_entry(qp, &hb->chain, list) { | ||
2434 | - if (qp->net == nf && f->match(qp, arg)) { | ||
2435 | - atomic_inc(&qp->refcnt); | ||
2436 | - spin_unlock(&hb->chain_lock); | ||
2437 | - qp_in->flags |= INET_FRAG_COMPLETE; | ||
2438 | - inet_frag_put(qp_in, f); | ||
2439 | - return qp; | ||
2440 | - } | ||
2441 | - } | ||
2442 | -#endif | ||
2443 | - qp = qp_in; | ||
2444 | - if (!mod_timer(&qp->timer, jiffies + nf->timeout)) | ||
2445 | - atomic_inc(&qp->refcnt); | ||
2446 | - | ||
2447 | - atomic_inc(&qp->refcnt); | ||
2448 | - hlist_add_head(&qp->list, &hb->chain); | ||
2449 | - | ||
2450 | - spin_unlock(&hb->chain_lock); | ||
2451 | - | ||
2452 | - return qp; | ||
2453 | -} | ||
2454 | - | ||
2455 | static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, | ||
2456 | struct inet_frags *f, | ||
2457 | void *arg) | ||
2458 | { | ||
2459 | struct inet_frag_queue *q; | ||
2460 | |||
2461 | + if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) | ||
2462 | + return NULL; | ||
2463 | + | ||
2464 | q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); | ||
2465 | if (!q) | ||
2466 | return NULL; | ||
2467 | @@ -366,75 +174,50 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, | ||
2468 | |||
2469 | setup_timer(&q->timer, f->frag_expire, (unsigned long)q); | ||
2470 | spin_lock_init(&q->lock); | ||
2471 | - atomic_set(&q->refcnt, 1); | ||
2472 | + atomic_set(&q->refcnt, 3); | ||
2473 | |||
2474 | return q; | ||
2475 | } | ||
2476 | |||
2477 | static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, | ||
2478 | - struct inet_frags *f, | ||
2479 | void *arg) | ||
2480 | { | ||
2481 | + struct inet_frags *f = nf->f; | ||
2482 | struct inet_frag_queue *q; | ||
2483 | + int err; | ||
2484 | |||
2485 | q = inet_frag_alloc(nf, f, arg); | ||
2486 | if (!q) | ||
2487 | return NULL; | ||
2488 | |||
2489 | - return inet_frag_intern(nf, q, f, arg); | ||
2490 | -} | ||
2491 | + mod_timer(&q->timer, jiffies + nf->timeout); | ||
2492 | |||
2493 | -struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, | ||
2494 | - struct inet_frags *f, void *key, | ||
2495 | - unsigned int hash) | ||
2496 | -{ | ||
2497 | - struct inet_frag_bucket *hb; | ||
2498 | - struct inet_frag_queue *q; | ||
2499 | - int depth = 0; | ||
2500 | - | ||
2501 | - if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { | ||
2502 | - inet_frag_schedule_worker(f); | ||
2503 | + err = rhashtable_insert_fast(&nf->rhashtable, &q->node, | ||
2504 | + f->rhash_params); | ||
2505 | + if (err < 0) { | ||
2506 | + q->flags |= INET_FRAG_COMPLETE; | ||
2507 | + inet_frag_kill(q); | ||
2508 | + inet_frag_destroy(q); | ||
2509 | return NULL; | ||
2510 | } | ||
2511 | - | ||
2512 | - if (frag_mem_limit(nf) > nf->low_thresh) | ||
2513 | - inet_frag_schedule_worker(f); | ||
2514 | - | ||
2515 | - hash &= (INETFRAGS_HASHSZ - 1); | ||
2516 | - hb = &f->hash[hash]; | ||
2517 | - | ||
2518 | - spin_lock(&hb->chain_lock); | ||
2519 | - hlist_for_each_entry(q, &hb->chain, list) { | ||
2520 | - if (q->net == nf && f->match(q, key)) { | ||
2521 | - atomic_inc(&q->refcnt); | ||
2522 | - spin_unlock(&hb->chain_lock); | ||
2523 | - return q; | ||
2524 | - } | ||
2525 | - depth++; | ||
2526 | - } | ||
2527 | - spin_unlock(&hb->chain_lock); | ||
2528 | - | ||
2529 | - if (depth <= INETFRAGS_MAXDEPTH) | ||
2530 | - return inet_frag_create(nf, f, key); | ||
2531 | - | ||
2532 | - if (inet_frag_may_rebuild(f)) { | ||
2533 | - if (!f->rebuild) | ||
2534 | - f->rebuild = true; | ||
2535 | - inet_frag_schedule_worker(f); | ||
2536 | - } | ||
2537 | - | ||
2538 | - return ERR_PTR(-ENOBUFS); | ||
2539 | + return q; | ||
2540 | } | ||
2541 | -EXPORT_SYMBOL(inet_frag_find); | ||
2542 | +EXPORT_SYMBOL(inet_frag_create); | ||
2543 | |||
2544 | -void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q, | ||
2545 | - const char *prefix) | ||
2546 | +/* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */ | ||
2547 | +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key) | ||
2548 | { | ||
2549 | - static const char msg[] = "inet_frag_find: Fragment hash bucket" | ||
2550 | - " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH) | ||
2551 | - ". Dropping fragment.\n"; | ||
2552 | + struct inet_frag_queue *fq; | ||
2553 | |||
2554 | - if (PTR_ERR(q) == -ENOBUFS) | ||
2555 | - net_dbg_ratelimited("%s%s", prefix, msg); | ||
2556 | + rcu_read_lock(); | ||
2557 | + fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params); | ||
2558 | + if (fq) { | ||
2559 | + if (!atomic_inc_not_zero(&fq->refcnt)) | ||
2560 | + fq = NULL; | ||
2561 | + rcu_read_unlock(); | ||
2562 | + return fq; | ||
2563 | + } | ||
2564 | + rcu_read_unlock(); | ||
2565 | + return inet_frag_create(nf, key); | ||
2566 | } | ||
2567 | -EXPORT_SYMBOL(inet_frag_maybe_warn_overflow); | ||
2568 | +EXPORT_SYMBOL(inet_frag_find); | ||
2569 | diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c | ||
2570 | index 752711cd4834..cc8c6ac84d08 100644 | ||
2571 | --- a/net/ipv4/ip_fragment.c | ||
2572 | +++ b/net/ipv4/ip_fragment.c | ||
2573 | @@ -56,27 +56,64 @@ | ||
2574 | */ | ||
2575 | static const char ip_frag_cache_name[] = "ip4-frags"; | ||
2576 | |||
2577 | -struct ipfrag_skb_cb | ||
2578 | -{ | ||
2579 | +/* Use skb->cb to track consecutive/adjacent fragments coming at | ||
2580 | + * the end of the queue. Nodes in the rb-tree queue will | ||
2581 | + * contain "runs" of one or more adjacent fragments. | ||
2582 | + * | ||
2583 | + * Invariants: | ||
2584 | + * - next_frag is NULL at the tail of a "run"; | ||
2585 | + * - the head of a "run" has the sum of all fragment lengths in frag_run_len. | ||
2586 | + */ | ||
2587 | +struct ipfrag_skb_cb { | ||
2588 | struct inet_skb_parm h; | ||
2589 | - int offset; | ||
2590 | + struct sk_buff *next_frag; | ||
2591 | + int frag_run_len; | ||
2592 | }; | ||
2593 | |||
2594 | -#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) | ||
2595 | +#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb)) | ||
2596 | + | ||
2597 | +static void ip4_frag_init_run(struct sk_buff *skb) | ||
2598 | +{ | ||
2599 | + BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb)); | ||
2600 | + | ||
2601 | + FRAG_CB(skb)->next_frag = NULL; | ||
2602 | + FRAG_CB(skb)->frag_run_len = skb->len; | ||
2603 | +} | ||
2604 | + | ||
2605 | +/* Append skb to the last "run". */ | ||
2606 | +static void ip4_frag_append_to_last_run(struct inet_frag_queue *q, | ||
2607 | + struct sk_buff *skb) | ||
2608 | +{ | ||
2609 | + RB_CLEAR_NODE(&skb->rbnode); | ||
2610 | + FRAG_CB(skb)->next_frag = NULL; | ||
2611 | + | ||
2612 | + FRAG_CB(q->last_run_head)->frag_run_len += skb->len; | ||
2613 | + FRAG_CB(q->fragments_tail)->next_frag = skb; | ||
2614 | + q->fragments_tail = skb; | ||
2615 | +} | ||
2616 | + | ||
2617 | +/* Create a new "run" with the skb. */ | ||
2618 | +static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb) | ||
2619 | +{ | ||
2620 | + if (q->last_run_head) | ||
2621 | + rb_link_node(&skb->rbnode, &q->last_run_head->rbnode, | ||
2622 | + &q->last_run_head->rbnode.rb_right); | ||
2623 | + else | ||
2624 | + rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node); | ||
2625 | + rb_insert_color(&skb->rbnode, &q->rb_fragments); | ||
2626 | + | ||
2627 | + ip4_frag_init_run(skb); | ||
2628 | + q->fragments_tail = skb; | ||
2629 | + q->last_run_head = skb; | ||
2630 | +} | ||
2631 | |||
2632 | /* Describe an entry in the "incomplete datagrams" queue. */ | ||
2633 | struct ipq { | ||
2634 | struct inet_frag_queue q; | ||
2635 | |||
2636 | - u32 user; | ||
2637 | - __be32 saddr; | ||
2638 | - __be32 daddr; | ||
2639 | - __be16 id; | ||
2640 | - u8 protocol; | ||
2641 | u8 ecn; /* RFC3168 support */ | ||
2642 | u16 max_df_size; /* largest frag with DF set seen */ | ||
2643 | int iif; | ||
2644 | - int vif; /* L3 master device index */ | ||
2645 | unsigned int rid; | ||
2646 | struct inet_peer *peer; | ||
2647 | }; | ||
2648 | @@ -88,49 +125,9 @@ static u8 ip4_frag_ecn(u8 tos) | ||
2649 | |||
2650 | static struct inet_frags ip4_frags; | ||
2651 | |||
2652 | -int ip_frag_mem(struct net *net) | ||
2653 | -{ | ||
2654 | - return sum_frag_mem_limit(&net->ipv4.frags); | ||
2655 | -} | ||
2656 | - | ||
2657 | -static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, | ||
2658 | - struct net_device *dev); | ||
2659 | - | ||
2660 | -struct ip4_create_arg { | ||
2661 | - struct iphdr *iph; | ||
2662 | - u32 user; | ||
2663 | - int vif; | ||
2664 | -}; | ||
2665 | +static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, | ||
2666 | + struct sk_buff *prev_tail, struct net_device *dev); | ||
2667 | |||
2668 | -static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot) | ||
2669 | -{ | ||
2670 | - net_get_random_once(&ip4_frags.rnd, sizeof(ip4_frags.rnd)); | ||
2671 | - return jhash_3words((__force u32)id << 16 | prot, | ||
2672 | - (__force u32)saddr, (__force u32)daddr, | ||
2673 | - ip4_frags.rnd); | ||
2674 | -} | ||
2675 | - | ||
2676 | -static unsigned int ip4_hashfn(const struct inet_frag_queue *q) | ||
2677 | -{ | ||
2678 | - const struct ipq *ipq; | ||
2679 | - | ||
2680 | - ipq = container_of(q, struct ipq, q); | ||
2681 | - return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol); | ||
2682 | -} | ||
2683 | - | ||
2684 | -static bool ip4_frag_match(const struct inet_frag_queue *q, const void *a) | ||
2685 | -{ | ||
2686 | - const struct ipq *qp; | ||
2687 | - const struct ip4_create_arg *arg = a; | ||
2688 | - | ||
2689 | - qp = container_of(q, struct ipq, q); | ||
2690 | - return qp->id == arg->iph->id && | ||
2691 | - qp->saddr == arg->iph->saddr && | ||
2692 | - qp->daddr == arg->iph->daddr && | ||
2693 | - qp->protocol == arg->iph->protocol && | ||
2694 | - qp->user == arg->user && | ||
2695 | - qp->vif == arg->vif; | ||
2696 | -} | ||
2697 | |||
2698 | static void ip4_frag_init(struct inet_frag_queue *q, const void *a) | ||
2699 | { | ||
2700 | @@ -139,17 +136,12 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a) | ||
2701 | frags); | ||
2702 | struct net *net = container_of(ipv4, struct net, ipv4); | ||
2703 | |||
2704 | - const struct ip4_create_arg *arg = a; | ||
2705 | + const struct frag_v4_compare_key *key = a; | ||
2706 | |||
2707 | - qp->protocol = arg->iph->protocol; | ||
2708 | - qp->id = arg->iph->id; | ||
2709 | - qp->ecn = ip4_frag_ecn(arg->iph->tos); | ||
2710 | - qp->saddr = arg->iph->saddr; | ||
2711 | - qp->daddr = arg->iph->daddr; | ||
2712 | - qp->vif = arg->vif; | ||
2713 | - qp->user = arg->user; | ||
2714 | + q->key.v4 = *key; | ||
2715 | + qp->ecn = 0; | ||
2716 | qp->peer = q->net->max_dist ? | ||
2717 | - inet_getpeer_v4(net->ipv4.peers, arg->iph->saddr, arg->vif, 1) : | ||
2718 | + inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) : | ||
2719 | NULL; | ||
2720 | } | ||
2721 | |||
2722 | @@ -167,7 +159,7 @@ static void ip4_frag_free(struct inet_frag_queue *q) | ||
2723 | |||
2724 | static void ipq_put(struct ipq *ipq) | ||
2725 | { | ||
2726 | - inet_frag_put(&ipq->q, &ip4_frags); | ||
2727 | + inet_frag_put(&ipq->q); | ||
2728 | } | ||
2729 | |||
2730 | /* Kill ipq entry. It is not destroyed immediately, | ||
2731 | @@ -175,7 +167,7 @@ static void ipq_put(struct ipq *ipq) | ||
2732 | */ | ||
2733 | static void ipq_kill(struct ipq *ipq) | ||
2734 | { | ||
2735 | - inet_frag_kill(&ipq->q, &ip4_frags); | ||
2736 | + inet_frag_kill(&ipq->q); | ||
2737 | } | ||
2738 | |||
2739 | static bool frag_expire_skip_icmp(u32 user) | ||
2740 | @@ -192,8 +184,11 @@ static bool frag_expire_skip_icmp(u32 user) | ||
2741 | */ | ||
2742 | static void ip_expire(unsigned long arg) | ||
2743 | { | ||
2744 | - struct ipq *qp; | ||
2745 | + const struct iphdr *iph; | ||
2746 | + struct sk_buff *head = NULL; | ||
2747 | struct net *net; | ||
2748 | + struct ipq *qp; | ||
2749 | + int err; | ||
2750 | |||
2751 | qp = container_of((struct inet_frag_queue *) arg, struct ipq, q); | ||
2752 | net = container_of(qp->q.net, struct net, ipv4.frags); | ||
2753 | @@ -206,51 +201,65 @@ static void ip_expire(unsigned long arg) | ||
2754 | |||
2755 | ipq_kill(qp); | ||
2756 | __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); | ||
2757 | + __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); | ||
2758 | |||
2759 | - if (!inet_frag_evicting(&qp->q)) { | ||
2760 | - struct sk_buff *clone, *head = qp->q.fragments; | ||
2761 | - const struct iphdr *iph; | ||
2762 | - int err; | ||
2763 | - | ||
2764 | - __IP_INC_STATS(net, IPSTATS_MIB_REASMTIMEOUT); | ||
2765 | + if (!(qp->q.flags & INET_FRAG_FIRST_IN)) | ||
2766 | + goto out; | ||
2767 | |||
2768 | - if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) | ||
2769 | + /* sk_buff::dev and sk_buff::rbnode are unionized. So we | ||
2770 | + * pull the head out of the tree in order to be able to | ||
2771 | + * deal with head->dev. | ||
2772 | + */ | ||
2773 | + if (qp->q.fragments) { | ||
2774 | + head = qp->q.fragments; | ||
2775 | + qp->q.fragments = head->next; | ||
2776 | + } else { | ||
2777 | + head = skb_rb_first(&qp->q.rb_fragments); | ||
2778 | + if (!head) | ||
2779 | goto out; | ||
2780 | + if (FRAG_CB(head)->next_frag) | ||
2781 | + rb_replace_node(&head->rbnode, | ||
2782 | + &FRAG_CB(head)->next_frag->rbnode, | ||
2783 | + &qp->q.rb_fragments); | ||
2784 | + else | ||
2785 | + rb_erase(&head->rbnode, &qp->q.rb_fragments); | ||
2786 | + memset(&head->rbnode, 0, sizeof(head->rbnode)); | ||
2787 | + barrier(); | ||
2788 | + } | ||
2789 | + if (head == qp->q.fragments_tail) | ||
2790 | + qp->q.fragments_tail = NULL; | ||
2791 | |||
2792 | - head->dev = dev_get_by_index_rcu(net, qp->iif); | ||
2793 | - if (!head->dev) | ||
2794 | - goto out; | ||
2795 | + sub_frag_mem_limit(qp->q.net, head->truesize); | ||
2796 | + | ||
2797 | + head->dev = dev_get_by_index_rcu(net, qp->iif); | ||
2798 | + if (!head->dev) | ||
2799 | + goto out; | ||
2800 | |||
2801 | |||
2802 | - /* skb has no dst, perform route lookup again */ | ||
2803 | - iph = ip_hdr(head); | ||
2804 | - err = ip_route_input_noref(head, iph->daddr, iph->saddr, | ||
2805 | + /* skb has no dst, perform route lookup again */ | ||
2806 | + iph = ip_hdr(head); | ||
2807 | + err = ip_route_input_noref(head, iph->daddr, iph->saddr, | ||
2808 | iph->tos, head->dev); | ||
2809 | - if (err) | ||
2810 | - goto out; | ||
2811 | + if (err) | ||
2812 | + goto out; | ||
2813 | |||
2814 | - /* Only an end host needs to send an ICMP | ||
2815 | - * "Fragment Reassembly Timeout" message, per RFC792. | ||
2816 | - */ | ||
2817 | - if (frag_expire_skip_icmp(qp->user) && | ||
2818 | - (skb_rtable(head)->rt_type != RTN_LOCAL)) | ||
2819 | - goto out; | ||
2820 | + /* Only an end host needs to send an ICMP | ||
2821 | + * "Fragment Reassembly Timeout" message, per RFC792. | ||
2822 | + */ | ||
2823 | + if (frag_expire_skip_icmp(qp->q.key.v4.user) && | ||
2824 | + (skb_rtable(head)->rt_type != RTN_LOCAL)) | ||
2825 | + goto out; | ||
2826 | |||
2827 | - clone = skb_clone(head, GFP_ATOMIC); | ||
2828 | + spin_unlock(&qp->q.lock); | ||
2829 | + icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); | ||
2830 | + goto out_rcu_unlock; | ||
2831 | |||
2832 | - /* Send an ICMP "Fragment Reassembly Timeout" message. */ | ||
2833 | - if (clone) { | ||
2834 | - spin_unlock(&qp->q.lock); | ||
2835 | - icmp_send(clone, ICMP_TIME_EXCEEDED, | ||
2836 | - ICMP_EXC_FRAGTIME, 0); | ||
2837 | - consume_skb(clone); | ||
2838 | - goto out_rcu_unlock; | ||
2839 | - } | ||
2840 | - } | ||
2841 | out: | ||
2842 | spin_unlock(&qp->q.lock); | ||
2843 | out_rcu_unlock: | ||
2844 | rcu_read_unlock(); | ||
2845 | + if (head) | ||
2846 | + kfree_skb(head); | ||
2847 | ipq_put(qp); | ||
2848 | } | ||
2849 | |||
2850 | @@ -260,21 +269,20 @@ out_rcu_unlock: | ||
2851 | static struct ipq *ip_find(struct net *net, struct iphdr *iph, | ||
2852 | u32 user, int vif) | ||
2853 | { | ||
2854 | + struct frag_v4_compare_key key = { | ||
2855 | + .saddr = iph->saddr, | ||
2856 | + .daddr = iph->daddr, | ||
2857 | + .user = user, | ||
2858 | + .vif = vif, | ||
2859 | + .id = iph->id, | ||
2860 | + .protocol = iph->protocol, | ||
2861 | + }; | ||
2862 | struct inet_frag_queue *q; | ||
2863 | - struct ip4_create_arg arg; | ||
2864 | - unsigned int hash; | ||
2865 | - | ||
2866 | - arg.iph = iph; | ||
2867 | - arg.user = user; | ||
2868 | - arg.vif = vif; | ||
2869 | |||
2870 | - hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol); | ||
2871 | - | ||
2872 | - q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash); | ||
2873 | - if (IS_ERR_OR_NULL(q)) { | ||
2874 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); | ||
2875 | + q = inet_frag_find(&net->ipv4.frags, &key); | ||
2876 | + if (!q) | ||
2877 | return NULL; | ||
2878 | - } | ||
2879 | + | ||
2880 | return container_of(q, struct ipq, q); | ||
2881 | } | ||
2882 | |||
2883 | @@ -294,7 +302,7 @@ static int ip_frag_too_far(struct ipq *qp) | ||
2884 | end = atomic_inc_return(&peer->rid); | ||
2885 | qp->rid = end; | ||
2886 | |||
2887 | - rc = qp->q.fragments && (end - start) > max; | ||
2888 | + rc = qp->q.fragments_tail && (end - start) > max; | ||
2889 | |||
2890 | if (rc) { | ||
2891 | struct net *net; | ||
2892 | @@ -308,7 +316,6 @@ static int ip_frag_too_far(struct ipq *qp) | ||
2893 | |||
2894 | static int ip_frag_reinit(struct ipq *qp) | ||
2895 | { | ||
2896 | - struct sk_buff *fp; | ||
2897 | unsigned int sum_truesize = 0; | ||
2898 | |||
2899 | if (!mod_timer(&qp->q.timer, jiffies + qp->q.net->timeout)) { | ||
2900 | @@ -316,21 +323,16 @@ static int ip_frag_reinit(struct ipq *qp) | ||
2901 | return -ETIMEDOUT; | ||
2902 | } | ||
2903 | |||
2904 | - fp = qp->q.fragments; | ||
2905 | - do { | ||
2906 | - struct sk_buff *xp = fp->next; | ||
2907 | - | ||
2908 | - sum_truesize += fp->truesize; | ||
2909 | - kfree_skb(fp); | ||
2910 | - fp = xp; | ||
2911 | - } while (fp); | ||
2912 | + sum_truesize = inet_frag_rbtree_purge(&qp->q.rb_fragments); | ||
2913 | sub_frag_mem_limit(qp->q.net, sum_truesize); | ||
2914 | |||
2915 | qp->q.flags = 0; | ||
2916 | qp->q.len = 0; | ||
2917 | qp->q.meat = 0; | ||
2918 | qp->q.fragments = NULL; | ||
2919 | + qp->q.rb_fragments = RB_ROOT; | ||
2920 | qp->q.fragments_tail = NULL; | ||
2921 | + qp->q.last_run_head = NULL; | ||
2922 | qp->iif = 0; | ||
2923 | qp->ecn = 0; | ||
2924 | |||
2925 | @@ -340,7 +342,9 @@ static int ip_frag_reinit(struct ipq *qp) | ||
2926 | /* Add new segment to existing queue. */ | ||
2927 | static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) | ||
2928 | { | ||
2929 | - struct sk_buff *prev, *next; | ||
2930 | + struct net *net = container_of(qp->q.net, struct net, ipv4.frags); | ||
2931 | + struct rb_node **rbn, *parent; | ||
2932 | + struct sk_buff *skb1, *prev_tail; | ||
2933 | struct net_device *dev; | ||
2934 | unsigned int fragsize; | ||
2935 | int flags, offset; | ||
2936 | @@ -403,99 +407,61 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) | ||
2937 | if (err) | ||
2938 | goto err; | ||
2939 | |||
2940 | - /* Find out which fragments are in front and at the back of us | ||
2941 | - * in the chain of fragments so far. We must know where to put | ||
2942 | - * this fragment, right? | ||
2943 | - */ | ||
2944 | - prev = qp->q.fragments_tail; | ||
2945 | - if (!prev || FRAG_CB(prev)->offset < offset) { | ||
2946 | - next = NULL; | ||
2947 | - goto found; | ||
2948 | - } | ||
2949 | - prev = NULL; | ||
2950 | - for (next = qp->q.fragments; next != NULL; next = next->next) { | ||
2951 | - if (FRAG_CB(next)->offset >= offset) | ||
2952 | - break; /* bingo! */ | ||
2953 | - prev = next; | ||
2954 | - } | ||
2955 | - | ||
2956 | -found: | ||
2957 | - /* We found where to put this one. Check for overlap with | ||
2958 | - * preceding fragment, and, if needed, align things so that | ||
2959 | - * any overlaps are eliminated. | ||
2960 | + /* Note : skb->rbnode and skb->dev share the same location. */ | ||
2961 | + dev = skb->dev; | ||
2962 | + /* Makes sure compiler wont do silly aliasing games */ | ||
2963 | + barrier(); | ||
2964 | + | ||
2965 | + /* RFC5722, Section 4, amended by Errata ID : 3089 | ||
2966 | + * When reassembling an IPv6 datagram, if | ||
2967 | + * one or more its constituent fragments is determined to be an | ||
2968 | + * overlapping fragment, the entire datagram (and any constituent | ||
2969 | + * fragments) MUST be silently discarded. | ||
2970 | + * | ||
2971 | + * We do the same here for IPv4 (and increment an snmp counter). | ||
2972 | */ | ||
2973 | - if (prev) { | ||
2974 | - int i = (FRAG_CB(prev)->offset + prev->len) - offset; | ||
2975 | |||
2976 | - if (i > 0) { | ||
2977 | - offset += i; | ||
2978 | - err = -EINVAL; | ||
2979 | - if (end <= offset) | ||
2980 | - goto err; | ||
2981 | - err = -ENOMEM; | ||
2982 | - if (!pskb_pull(skb, i)) | ||
2983 | - goto err; | ||
2984 | - if (skb->ip_summed != CHECKSUM_UNNECESSARY) | ||
2985 | - skb->ip_summed = CHECKSUM_NONE; | ||
2986 | - } | ||
2987 | - } | ||
2988 | - | ||
2989 | - err = -ENOMEM; | ||
2990 | - | ||
2991 | - while (next && FRAG_CB(next)->offset < end) { | ||
2992 | - int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ | ||
2993 | - | ||
2994 | - if (i < next->len) { | ||
2995 | - int delta = -next->truesize; | ||
2996 | - | ||
2997 | - /* Eat head of the next overlapped fragment | ||
2998 | - * and leave the loop. The next ones cannot overlap. | ||
2999 | - */ | ||
3000 | - if (!pskb_pull(next, i)) | ||
3001 | - goto err; | ||
3002 | - delta += next->truesize; | ||
3003 | - if (delta) | ||
3004 | - add_frag_mem_limit(qp->q.net, delta); | ||
3005 | - FRAG_CB(next)->offset += i; | ||
3006 | - qp->q.meat -= i; | ||
3007 | - if (next->ip_summed != CHECKSUM_UNNECESSARY) | ||
3008 | - next->ip_summed = CHECKSUM_NONE; | ||
3009 | - break; | ||
3010 | - } else { | ||
3011 | - struct sk_buff *free_it = next; | ||
3012 | - | ||
3013 | - /* Old fragment is completely overridden with | ||
3014 | - * new one drop it. | ||
3015 | - */ | ||
3016 | - next = next->next; | ||
3017 | - | ||
3018 | - if (prev) | ||
3019 | - prev->next = next; | ||
3020 | - else | ||
3021 | - qp->q.fragments = next; | ||
3022 | - | ||
3023 | - qp->q.meat -= free_it->len; | ||
3024 | - sub_frag_mem_limit(qp->q.net, free_it->truesize); | ||
3025 | - kfree_skb(free_it); | ||
3026 | - } | ||
3027 | + /* Find out where to put this fragment. */ | ||
3028 | + prev_tail = qp->q.fragments_tail; | ||
3029 | + if (!prev_tail) | ||
3030 | + ip4_frag_create_run(&qp->q, skb); /* First fragment. */ | ||
3031 | + else if (prev_tail->ip_defrag_offset + prev_tail->len < end) { | ||
3032 | + /* This is the common case: skb goes to the end. */ | ||
3033 | + /* Detect and discard overlaps. */ | ||
3034 | + if (offset < prev_tail->ip_defrag_offset + prev_tail->len) | ||
3035 | + goto discard_qp; | ||
3036 | + if (offset == prev_tail->ip_defrag_offset + prev_tail->len) | ||
3037 | + ip4_frag_append_to_last_run(&qp->q, skb); | ||
3038 | + else | ||
3039 | + ip4_frag_create_run(&qp->q, skb); | ||
3040 | + } else { | ||
3041 | + /* Binary search. Note that skb can become the first fragment, | ||
3042 | + * but not the last (covered above). | ||
3043 | + */ | ||
3044 | + rbn = &qp->q.rb_fragments.rb_node; | ||
3045 | + do { | ||
3046 | + parent = *rbn; | ||
3047 | + skb1 = rb_to_skb(parent); | ||
3048 | + if (end <= skb1->ip_defrag_offset) | ||
3049 | + rbn = &parent->rb_left; | ||
3050 | + else if (offset >= skb1->ip_defrag_offset + | ||
3051 | + FRAG_CB(skb1)->frag_run_len) | ||
3052 | + rbn = &parent->rb_right; | ||
3053 | + else /* Found an overlap with skb1. */ | ||
3054 | + goto discard_qp; | ||
3055 | + } while (*rbn); | ||
3056 | + /* Here we have parent properly set, and rbn pointing to | ||
3057 | + * one of its NULL left/right children. Insert skb. | ||
3058 | + */ | ||
3059 | + ip4_frag_init_run(skb); | ||
3060 | + rb_link_node(&skb->rbnode, parent, rbn); | ||
3061 | + rb_insert_color(&skb->rbnode, &qp->q.rb_fragments); | ||
3062 | } | ||
3063 | |||
3064 | - FRAG_CB(skb)->offset = offset; | ||
3065 | - | ||
3066 | - /* Insert this fragment in the chain of fragments. */ | ||
3067 | - skb->next = next; | ||
3068 | - if (!next) | ||
3069 | - qp->q.fragments_tail = skb; | ||
3070 | - if (prev) | ||
3071 | - prev->next = skb; | ||
3072 | - else | ||
3073 | - qp->q.fragments = skb; | ||
3074 | - | ||
3075 | - dev = skb->dev; | ||
3076 | - if (dev) { | ||
3077 | + if (dev) | ||
3078 | qp->iif = dev->ifindex; | ||
3079 | - skb->dev = NULL; | ||
3080 | - } | ||
3081 | + skb->ip_defrag_offset = offset; | ||
3082 | + | ||
3083 | qp->q.stamp = skb->tstamp; | ||
3084 | qp->q.meat += skb->len; | ||
3085 | qp->ecn |= ecn; | ||
3086 | @@ -517,7 +483,7 @@ found: | ||
3087 | unsigned long orefdst = skb->_skb_refdst; | ||
3088 | |||
3089 | skb->_skb_refdst = 0UL; | ||
3090 | - err = ip_frag_reasm(qp, prev, dev); | ||
3091 | + err = ip_frag_reasm(qp, skb, prev_tail, dev); | ||
3092 | skb->_skb_refdst = orefdst; | ||
3093 | return err; | ||
3094 | } | ||
3095 | @@ -525,20 +491,24 @@ found: | ||
3096 | skb_dst_drop(skb); | ||
3097 | return -EINPROGRESS; | ||
3098 | |||
3099 | +discard_qp: | ||
3100 | + inet_frag_kill(&qp->q); | ||
3101 | + err = -EINVAL; | ||
3102 | + __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS); | ||
3103 | err: | ||
3104 | kfree_skb(skb); | ||
3105 | return err; | ||
3106 | } | ||
3107 | |||
3108 | - | ||
3109 | /* Build a new IP datagram from all its fragments. */ | ||
3110 | - | ||
3111 | -static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, | ||
3112 | - struct net_device *dev) | ||
3113 | +static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb, | ||
3114 | + struct sk_buff *prev_tail, struct net_device *dev) | ||
3115 | { | ||
3116 | struct net *net = container_of(qp->q.net, struct net, ipv4.frags); | ||
3117 | struct iphdr *iph; | ||
3118 | - struct sk_buff *fp, *head = qp->q.fragments; | ||
3119 | + struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments); | ||
3120 | + struct sk_buff **nextp; /* To build frag_list. */ | ||
3121 | + struct rb_node *rbn; | ||
3122 | int len; | ||
3123 | int ihlen; | ||
3124 | int err; | ||
3125 | @@ -552,26 +522,27 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, | ||
3126 | goto out_fail; | ||
3127 | } | ||
3128 | /* Make the one we just received the head. */ | ||
3129 | - if (prev) { | ||
3130 | - head = prev->next; | ||
3131 | - fp = skb_clone(head, GFP_ATOMIC); | ||
3132 | + if (head != skb) { | ||
3133 | + fp = skb_clone(skb, GFP_ATOMIC); | ||
3134 | if (!fp) | ||
3135 | goto out_nomem; | ||
3136 | - | ||
3137 | - fp->next = head->next; | ||
3138 | - if (!fp->next) | ||
3139 | + FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag; | ||
3140 | + if (RB_EMPTY_NODE(&skb->rbnode)) | ||
3141 | + FRAG_CB(prev_tail)->next_frag = fp; | ||
3142 | + else | ||
3143 | + rb_replace_node(&skb->rbnode, &fp->rbnode, | ||
3144 | + &qp->q.rb_fragments); | ||
3145 | + if (qp->q.fragments_tail == skb) | ||
3146 | qp->q.fragments_tail = fp; | ||
3147 | - prev->next = fp; | ||
3148 | - | ||
3149 | - skb_morph(head, qp->q.fragments); | ||
3150 | - head->next = qp->q.fragments->next; | ||
3151 | - | ||
3152 | - consume_skb(qp->q.fragments); | ||
3153 | - qp->q.fragments = head; | ||
3154 | + skb_morph(skb, head); | ||
3155 | + FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag; | ||
3156 | + rb_replace_node(&head->rbnode, &skb->rbnode, | ||
3157 | + &qp->q.rb_fragments); | ||
3158 | + consume_skb(head); | ||
3159 | + head = skb; | ||
3160 | } | ||
3161 | |||
3162 | - WARN_ON(!head); | ||
3163 | - WARN_ON(FRAG_CB(head)->offset != 0); | ||
3164 | + WARN_ON(head->ip_defrag_offset != 0); | ||
3165 | |||
3166 | /* Allocate a new buffer for the datagram. */ | ||
3167 | ihlen = ip_hdrlen(head); | ||
3168 | @@ -595,35 +566,61 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, | ||
3169 | clone = alloc_skb(0, GFP_ATOMIC); | ||
3170 | if (!clone) | ||
3171 | goto out_nomem; | ||
3172 | - clone->next = head->next; | ||
3173 | - head->next = clone; | ||
3174 | skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list; | ||
3175 | skb_frag_list_init(head); | ||
3176 | for (i = 0; i < skb_shinfo(head)->nr_frags; i++) | ||
3177 | plen += skb_frag_size(&skb_shinfo(head)->frags[i]); | ||
3178 | clone->len = clone->data_len = head->data_len - plen; | ||
3179 | - head->data_len -= clone->len; | ||
3180 | - head->len -= clone->len; | ||
3181 | + head->truesize += clone->truesize; | ||
3182 | clone->csum = 0; | ||
3183 | clone->ip_summed = head->ip_summed; | ||
3184 | add_frag_mem_limit(qp->q.net, clone->truesize); | ||
3185 | + skb_shinfo(head)->frag_list = clone; | ||
3186 | + nextp = &clone->next; | ||
3187 | + } else { | ||
3188 | + nextp = &skb_shinfo(head)->frag_list; | ||
3189 | } | ||
3190 | |||
3191 | - skb_shinfo(head)->frag_list = head->next; | ||
3192 | skb_push(head, head->data - skb_network_header(head)); | ||
3193 | |||
3194 | - for (fp=head->next; fp; fp = fp->next) { | ||
3195 | - head->data_len += fp->len; | ||
3196 | - head->len += fp->len; | ||
3197 | - if (head->ip_summed != fp->ip_summed) | ||
3198 | - head->ip_summed = CHECKSUM_NONE; | ||
3199 | - else if (head->ip_summed == CHECKSUM_COMPLETE) | ||
3200 | - head->csum = csum_add(head->csum, fp->csum); | ||
3201 | - head->truesize += fp->truesize; | ||
3202 | + /* Traverse the tree in order, to build frag_list. */ | ||
3203 | + fp = FRAG_CB(head)->next_frag; | ||
3204 | + rbn = rb_next(&head->rbnode); | ||
3205 | + rb_erase(&head->rbnode, &qp->q.rb_fragments); | ||
3206 | + while (rbn || fp) { | ||
3207 | + /* fp points to the next sk_buff in the current run; | ||
3208 | + * rbn points to the next run. | ||
3209 | + */ | ||
3210 | + /* Go through the current run. */ | ||
3211 | + while (fp) { | ||
3212 | + *nextp = fp; | ||
3213 | + nextp = &fp->next; | ||
3214 | + fp->prev = NULL; | ||
3215 | + memset(&fp->rbnode, 0, sizeof(fp->rbnode)); | ||
3216 | + fp->sk = NULL; | ||
3217 | + head->data_len += fp->len; | ||
3218 | + head->len += fp->len; | ||
3219 | + if (head->ip_summed != fp->ip_summed) | ||
3220 | + head->ip_summed = CHECKSUM_NONE; | ||
3221 | + else if (head->ip_summed == CHECKSUM_COMPLETE) | ||
3222 | + head->csum = csum_add(head->csum, fp->csum); | ||
3223 | + head->truesize += fp->truesize; | ||
3224 | + fp = FRAG_CB(fp)->next_frag; | ||
3225 | + } | ||
3226 | + /* Move to the next run. */ | ||
3227 | + if (rbn) { | ||
3228 | + struct rb_node *rbnext = rb_next(rbn); | ||
3229 | + | ||
3230 | + fp = rb_to_skb(rbn); | ||
3231 | + rb_erase(rbn, &qp->q.rb_fragments); | ||
3232 | + rbn = rbnext; | ||
3233 | + } | ||
3234 | } | ||
3235 | sub_frag_mem_limit(qp->q.net, head->truesize); | ||
3236 | |||
3237 | + *nextp = NULL; | ||
3238 | head->next = NULL; | ||
3239 | + head->prev = NULL; | ||
3240 | head->dev = dev; | ||
3241 | head->tstamp = qp->q.stamp; | ||
3242 | IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size); | ||
3243 | @@ -651,7 +648,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, | ||
3244 | |||
3245 | __IP_INC_STATS(net, IPSTATS_MIB_REASMOKS); | ||
3246 | qp->q.fragments = NULL; | ||
3247 | + qp->q.rb_fragments = RB_ROOT; | ||
3248 | qp->q.fragments_tail = NULL; | ||
3249 | + qp->q.last_run_head = NULL; | ||
3250 | return 0; | ||
3251 | |||
3252 | out_nomem: | ||
3253 | @@ -659,7 +658,7 @@ out_nomem: | ||
3254 | err = -ENOMEM; | ||
3255 | goto out_fail; | ||
3256 | out_oversize: | ||
3257 | - net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->saddr); | ||
3258 | + net_info_ratelimited("Oversized IP packet from %pI4\n", &qp->q.key.v4.saddr); | ||
3259 | out_fail: | ||
3260 | __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS); | ||
3261 | return err; | ||
3262 | @@ -733,25 +732,46 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user) | ||
3263 | } | ||
3264 | EXPORT_SYMBOL(ip_check_defrag); | ||
3265 | |||
3266 | +unsigned int inet_frag_rbtree_purge(struct rb_root *root) | ||
3267 | +{ | ||
3268 | + struct rb_node *p = rb_first(root); | ||
3269 | + unsigned int sum = 0; | ||
3270 | + | ||
3271 | + while (p) { | ||
3272 | + struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); | ||
3273 | + | ||
3274 | + p = rb_next(p); | ||
3275 | + rb_erase(&skb->rbnode, root); | ||
3276 | + while (skb) { | ||
3277 | + struct sk_buff *next = FRAG_CB(skb)->next_frag; | ||
3278 | + | ||
3279 | + sum += skb->truesize; | ||
3280 | + kfree_skb(skb); | ||
3281 | + skb = next; | ||
3282 | + } | ||
3283 | + } | ||
3284 | + return sum; | ||
3285 | +} | ||
3286 | +EXPORT_SYMBOL(inet_frag_rbtree_purge); | ||
3287 | + | ||
3288 | #ifdef CONFIG_SYSCTL | ||
3289 | -static int zero; | ||
3290 | +static int dist_min; | ||
3291 | |||
3292 | static struct ctl_table ip4_frags_ns_ctl_table[] = { | ||
3293 | { | ||
3294 | .procname = "ipfrag_high_thresh", | ||
3295 | .data = &init_net.ipv4.frags.high_thresh, | ||
3296 | - .maxlen = sizeof(int), | ||
3297 | + .maxlen = sizeof(unsigned long), | ||
3298 | .mode = 0644, | ||
3299 | - .proc_handler = proc_dointvec_minmax, | ||
3300 | + .proc_handler = proc_doulongvec_minmax, | ||
3301 | .extra1 = &init_net.ipv4.frags.low_thresh | ||
3302 | }, | ||
3303 | { | ||
3304 | .procname = "ipfrag_low_thresh", | ||
3305 | .data = &init_net.ipv4.frags.low_thresh, | ||
3306 | - .maxlen = sizeof(int), | ||
3307 | + .maxlen = sizeof(unsigned long), | ||
3308 | .mode = 0644, | ||
3309 | - .proc_handler = proc_dointvec_minmax, | ||
3310 | - .extra1 = &zero, | ||
3311 | + .proc_handler = proc_doulongvec_minmax, | ||
3312 | .extra2 = &init_net.ipv4.frags.high_thresh | ||
3313 | }, | ||
3314 | { | ||
3315 | @@ -767,7 +787,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = { | ||
3316 | .maxlen = sizeof(int), | ||
3317 | .mode = 0644, | ||
3318 | .proc_handler = proc_dointvec_minmax, | ||
3319 | - .extra1 = &zero | ||
3320 | + .extra1 = &dist_min, | ||
3321 | }, | ||
3322 | { } | ||
3323 | }; | ||
3324 | @@ -849,6 +869,8 @@ static void __init ip4_frags_ctl_register(void) | ||
3325 | |||
3326 | static int __net_init ipv4_frags_init_net(struct net *net) | ||
3327 | { | ||
3328 | + int res; | ||
3329 | + | ||
3330 | /* Fragment cache limits. | ||
3331 | * | ||
3332 | * The fragment memory accounting code, (tries to) account for | ||
3333 | @@ -873,16 +895,21 @@ static int __net_init ipv4_frags_init_net(struct net *net) | ||
3334 | net->ipv4.frags.timeout = IP_FRAG_TIME; | ||
3335 | |||
3336 | net->ipv4.frags.max_dist = 64; | ||
3337 | - | ||
3338 | - inet_frags_init_net(&net->ipv4.frags); | ||
3339 | - | ||
3340 | - return ip4_frags_ns_ctl_register(net); | ||
3341 | + net->ipv4.frags.f = &ip4_frags; | ||
3342 | + | ||
3343 | + res = inet_frags_init_net(&net->ipv4.frags); | ||
3344 | + if (res < 0) | ||
3345 | + return res; | ||
3346 | + res = ip4_frags_ns_ctl_register(net); | ||
3347 | + if (res < 0) | ||
3348 | + inet_frags_exit_net(&net->ipv4.frags); | ||
3349 | + return res; | ||
3350 | } | ||
3351 | |||
3352 | static void __net_exit ipv4_frags_exit_net(struct net *net) | ||
3353 | { | ||
3354 | ip4_frags_ns_ctl_unregister(net); | ||
3355 | - inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); | ||
3356 | + inet_frags_exit_net(&net->ipv4.frags); | ||
3357 | } | ||
3358 | |||
3359 | static struct pernet_operations ip4_frags_ops = { | ||
3360 | @@ -890,17 +917,49 @@ static struct pernet_operations ip4_frags_ops = { | ||
3361 | .exit = ipv4_frags_exit_net, | ||
3362 | }; | ||
3363 | |||
3364 | + | ||
3365 | +static u32 ip4_key_hashfn(const void *data, u32 len, u32 seed) | ||
3366 | +{ | ||
3367 | + return jhash2(data, | ||
3368 | + sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); | ||
3369 | +} | ||
3370 | + | ||
3371 | +static u32 ip4_obj_hashfn(const void *data, u32 len, u32 seed) | ||
3372 | +{ | ||
3373 | + const struct inet_frag_queue *fq = data; | ||
3374 | + | ||
3375 | + return jhash2((const u32 *)&fq->key.v4, | ||
3376 | + sizeof(struct frag_v4_compare_key) / sizeof(u32), seed); | ||
3377 | +} | ||
3378 | + | ||
3379 | +static int ip4_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) | ||
3380 | +{ | ||
3381 | + const struct frag_v4_compare_key *key = arg->key; | ||
3382 | + const struct inet_frag_queue *fq = ptr; | ||
3383 | + | ||
3384 | + return !!memcmp(&fq->key, key, sizeof(*key)); | ||
3385 | +} | ||
3386 | + | ||
3387 | +static const struct rhashtable_params ip4_rhash_params = { | ||
3388 | + .head_offset = offsetof(struct inet_frag_queue, node), | ||
3389 | + .key_offset = offsetof(struct inet_frag_queue, key), | ||
3390 | + .key_len = sizeof(struct frag_v4_compare_key), | ||
3391 | + .hashfn = ip4_key_hashfn, | ||
3392 | + .obj_hashfn = ip4_obj_hashfn, | ||
3393 | + .obj_cmpfn = ip4_obj_cmpfn, | ||
3394 | + .automatic_shrinking = true, | ||
3395 | +}; | ||
3396 | + | ||
3397 | void __init ipfrag_init(void) | ||
3398 | { | ||
3399 | - ip4_frags_ctl_register(); | ||
3400 | - register_pernet_subsys(&ip4_frags_ops); | ||
3401 | - ip4_frags.hashfn = ip4_hashfn; | ||
3402 | ip4_frags.constructor = ip4_frag_init; | ||
3403 | ip4_frags.destructor = ip4_frag_free; | ||
3404 | ip4_frags.qsize = sizeof(struct ipq); | ||
3405 | - ip4_frags.match = ip4_frag_match; | ||
3406 | ip4_frags.frag_expire = ip_expire; | ||
3407 | ip4_frags.frags_cache_name = ip_frag_cache_name; | ||
3408 | + ip4_frags.rhash_params = ip4_rhash_params; | ||
3409 | if (inet_frags_init(&ip4_frags)) | ||
3410 | panic("IP: failed to allocate ip4_frags cache\n"); | ||
3411 | + ip4_frags_ctl_register(); | ||
3412 | + register_pernet_subsys(&ip4_frags_ops); | ||
3413 | } | ||
3414 | diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c | ||
3415 | index b21e435f428c..a5851c0bc278 100644 | ||
3416 | --- a/net/ipv4/ip_sockglue.c | ||
3417 | +++ b/net/ipv4/ip_sockglue.c | ||
3418 | @@ -134,7 +134,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) | ||
3419 | static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) | ||
3420 | { | ||
3421 | struct sockaddr_in sin; | ||
3422 | - const struct iphdr *iph = ip_hdr(skb); | ||
3423 | __be16 *ports; | ||
3424 | int end; | ||
3425 | |||
3426 | @@ -149,7 +148,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) | ||
3427 | ports = (__be16 *)skb_transport_header(skb); | ||
3428 | |||
3429 | sin.sin_family = AF_INET; | ||
3430 | - sin.sin_addr.s_addr = iph->daddr; | ||
3431 | + sin.sin_addr.s_addr = ip_hdr(skb)->daddr; | ||
3432 | sin.sin_port = ports[1]; | ||
3433 | memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); | ||
3434 | |||
3435 | diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c | ||
3436 | index e1271e75e107..d8d99c21a9c1 100644 | ||
3437 | --- a/net/ipv4/ip_tunnel.c | ||
3438 | +++ b/net/ipv4/ip_tunnel.c | ||
3439 | @@ -627,6 +627,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, | ||
3440 | const struct iphdr *tnl_params, u8 protocol) | ||
3441 | { | ||
3442 | struct ip_tunnel *tunnel = netdev_priv(dev); | ||
3443 | + unsigned int inner_nhdr_len = 0; | ||
3444 | const struct iphdr *inner_iph; | ||
3445 | struct flowi4 fl4; | ||
3446 | u8 tos, ttl; | ||
3447 | @@ -636,6 +637,14 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, | ||
3448 | __be32 dst; | ||
3449 | bool connected; | ||
3450 | |||
3451 | + /* ensure we can access the inner net header, for several users below */ | ||
3452 | + if (skb->protocol == htons(ETH_P_IP)) | ||
3453 | + inner_nhdr_len = sizeof(struct iphdr); | ||
3454 | + else if (skb->protocol == htons(ETH_P_IPV6)) | ||
3455 | + inner_nhdr_len = sizeof(struct ipv6hdr); | ||
3456 | + if (unlikely(!pskb_may_pull(skb, inner_nhdr_len))) | ||
3457 | + goto tx_error; | ||
3458 | + | ||
3459 | inner_iph = (const struct iphdr *)skb_inner_network_header(skb); | ||
3460 | connected = (tunnel->parms.iph.daddr != 0); | ||
3461 | |||
3462 | diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c | ||
3463 | index 7143ca1a6af9..ec48d8eafc7e 100644 | ||
3464 | --- a/net/ipv4/proc.c | ||
3465 | +++ b/net/ipv4/proc.c | ||
3466 | @@ -54,7 +54,6 @@ | ||
3467 | static int sockstat_seq_show(struct seq_file *seq, void *v) | ||
3468 | { | ||
3469 | struct net *net = seq->private; | ||
3470 | - unsigned int frag_mem; | ||
3471 | int orphans, sockets; | ||
3472 | |||
3473 | local_bh_disable(); | ||
3474 | @@ -74,8 +73,9 @@ static int sockstat_seq_show(struct seq_file *seq, void *v) | ||
3475 | sock_prot_inuse_get(net, &udplite_prot)); | ||
3476 | seq_printf(seq, "RAW: inuse %d\n", | ||
3477 | sock_prot_inuse_get(net, &raw_prot)); | ||
3478 | - frag_mem = ip_frag_mem(net); | ||
3479 | - seq_printf(seq, "FRAG: inuse %u memory %u\n", !!frag_mem, frag_mem); | ||
3480 | + seq_printf(seq, "FRAG: inuse %u memory %lu\n", | ||
3481 | + atomic_read(&net->ipv4.frags.rhashtable.nelems), | ||
3482 | + frag_mem_limit(&net->ipv4.frags)); | ||
3483 | return 0; | ||
3484 | } | ||
3485 | |||
3486 | @@ -134,6 +134,7 @@ static const struct snmp_mib snmp4_ipextstats_list[] = { | ||
3487 | SNMP_MIB_ITEM("InECT1Pkts", IPSTATS_MIB_ECT1PKTS), | ||
3488 | SNMP_MIB_ITEM("InECT0Pkts", IPSTATS_MIB_ECT0PKTS), | ||
3489 | SNMP_MIB_ITEM("InCEPkts", IPSTATS_MIB_CEPKTS), | ||
3490 | + SNMP_MIB_ITEM("ReasmOverlaps", IPSTATS_MIB_REASM_OVERLAPS), | ||
3491 | SNMP_MIB_SENTINEL | ||
3492 | }; | ||
3493 | |||
3494 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
3495 | index 9d0b73aa649f..dbb153c6b21a 100644 | ||
3496 | --- a/net/ipv4/tcp_input.c | ||
3497 | +++ b/net/ipv4/tcp_input.c | ||
3498 | @@ -4406,7 +4406,7 @@ static void tcp_ofo_queue(struct sock *sk) | ||
3499 | |||
3500 | p = rb_first(&tp->out_of_order_queue); | ||
3501 | while (p) { | ||
3502 | - skb = rb_entry(p, struct sk_buff, rbnode); | ||
3503 | + skb = rb_to_skb(p); | ||
3504 | if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) | ||
3505 | break; | ||
3506 | |||
3507 | @@ -4470,7 +4470,7 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb, | ||
3508 | static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) | ||
3509 | { | ||
3510 | struct tcp_sock *tp = tcp_sk(sk); | ||
3511 | - struct rb_node **p, *q, *parent; | ||
3512 | + struct rb_node **p, *parent; | ||
3513 | struct sk_buff *skb1; | ||
3514 | u32 seq, end_seq; | ||
3515 | bool fragstolen; | ||
3516 | @@ -4529,7 +4529,7 @@ coalesce_done: | ||
3517 | parent = NULL; | ||
3518 | while (*p) { | ||
3519 | parent = *p; | ||
3520 | - skb1 = rb_entry(parent, struct sk_buff, rbnode); | ||
3521 | + skb1 = rb_to_skb(parent); | ||
3522 | if (before(seq, TCP_SKB_CB(skb1)->seq)) { | ||
3523 | p = &parent->rb_left; | ||
3524 | continue; | ||
3525 | @@ -4574,9 +4574,7 @@ insert: | ||
3526 | |||
3527 | merge_right: | ||
3528 | /* Remove other segments covered by skb. */ | ||
3529 | - while ((q = rb_next(&skb->rbnode)) != NULL) { | ||
3530 | - skb1 = rb_entry(q, struct sk_buff, rbnode); | ||
3531 | - | ||
3532 | + while ((skb1 = skb_rb_next(skb)) != NULL) { | ||
3533 | if (!after(end_seq, TCP_SKB_CB(skb1)->seq)) | ||
3534 | break; | ||
3535 | if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) { | ||
3536 | @@ -4591,7 +4589,7 @@ merge_right: | ||
3537 | tcp_drop(sk, skb1); | ||
3538 | } | ||
3539 | /* If there is no skb after us, we are the last_skb ! */ | ||
3540 | - if (!q) | ||
3541 | + if (!skb1) | ||
3542 | tp->ooo_last_skb = skb; | ||
3543 | |||
3544 | add_sack: | ||
3545 | @@ -4792,7 +4790,7 @@ static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *li | ||
3546 | if (list) | ||
3547 | return !skb_queue_is_last(list, skb) ? skb->next : NULL; | ||
3548 | |||
3549 | - return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode); | ||
3550 | + return skb_rb_next(skb); | ||
3551 | } | ||
3552 | |||
3553 | static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, | ||
3554 | @@ -4821,7 +4819,7 @@ static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb) | ||
3555 | |||
3556 | while (*p) { | ||
3557 | parent = *p; | ||
3558 | - skb1 = rb_entry(parent, struct sk_buff, rbnode); | ||
3559 | + skb1 = rb_to_skb(parent); | ||
3560 | if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq)) | ||
3561 | p = &parent->rb_left; | ||
3562 | else | ||
3563 | @@ -4941,19 +4939,12 @@ static void tcp_collapse_ofo_queue(struct sock *sk) | ||
3564 | struct tcp_sock *tp = tcp_sk(sk); | ||
3565 | u32 range_truesize, sum_tiny = 0; | ||
3566 | struct sk_buff *skb, *head; | ||
3567 | - struct rb_node *p; | ||
3568 | u32 start, end; | ||
3569 | |||
3570 | - p = rb_first(&tp->out_of_order_queue); | ||
3571 | - skb = rb_entry_safe(p, struct sk_buff, rbnode); | ||
3572 | + skb = skb_rb_first(&tp->out_of_order_queue); | ||
3573 | new_range: | ||
3574 | if (!skb) { | ||
3575 | - p = rb_last(&tp->out_of_order_queue); | ||
3576 | - /* Note: This is possible p is NULL here. We do not | ||
3577 | - * use rb_entry_safe(), as ooo_last_skb is valid only | ||
3578 | - * if rbtree is not empty. | ||
3579 | - */ | ||
3580 | - tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode); | ||
3581 | + tp->ooo_last_skb = skb_rb_last(&tp->out_of_order_queue); | ||
3582 | return; | ||
3583 | } | ||
3584 | start = TCP_SKB_CB(skb)->seq; | ||
3585 | @@ -4961,7 +4952,7 @@ new_range: | ||
3586 | range_truesize = skb->truesize; | ||
3587 | |||
3588 | for (head = skb;;) { | ||
3589 | - skb = tcp_skb_next(skb, NULL); | ||
3590 | + skb = skb_rb_next(skb); | ||
3591 | |||
3592 | /* Range is terminated when we see a gap or when | ||
3593 | * we are at the queue end. | ||
3594 | @@ -5017,7 +5008,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk) | ||
3595 | prev = rb_prev(node); | ||
3596 | rb_erase(node, &tp->out_of_order_queue); | ||
3597 | goal -= rb_to_skb(node)->truesize; | ||
3598 | - tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode)); | ||
3599 | + tcp_drop(sk, rb_to_skb(node)); | ||
3600 | if (!prev || goal <= 0) { | ||
3601 | sk_mem_reclaim(sk); | ||
3602 | if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && | ||
3603 | @@ -5027,7 +5018,7 @@ static bool tcp_prune_ofo_queue(struct sock *sk) | ||
3604 | } | ||
3605 | node = prev; | ||
3606 | } while (node); | ||
3607 | - tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode); | ||
3608 | + tp->ooo_last_skb = rb_to_skb(prev); | ||
3609 | |||
3610 | /* Reset SACK state. A conforming SACK implementation will | ||
3611 | * do the same at a timeout based retransmit. When a connection | ||
3612 | @@ -5978,11 +5969,13 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) | ||
3613 | if (th->fin) | ||
3614 | goto discard; | ||
3615 | /* It is possible that we process SYN packets from backlog, | ||
3616 | - * so we need to make sure to disable BH right there. | ||
3617 | + * so we need to make sure to disable BH and RCU right there. | ||
3618 | */ | ||
3619 | + rcu_read_lock(); | ||
3620 | local_bh_disable(); | ||
3621 | acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0; | ||
3622 | local_bh_enable(); | ||
3623 | + rcu_read_unlock(); | ||
3624 | |||
3625 | if (!acceptable) | ||
3626 | return 1; | ||
3627 | diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c | ||
3628 | index 16dea67792e0..1ea0c91ba994 100644 | ||
3629 | --- a/net/ipv4/tcp_ipv4.c | ||
3630 | +++ b/net/ipv4/tcp_ipv4.c | ||
3631 | @@ -859,9 +859,11 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst, | ||
3632 | if (skb) { | ||
3633 | __tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr); | ||
3634 | |||
3635 | + rcu_read_lock(); | ||
3636 | err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr, | ||
3637 | ireq->ir_rmt_addr, | ||
3638 | - ireq_opt_deref(ireq)); | ||
3639 | + rcu_dereference(ireq->ireq_opt)); | ||
3640 | + rcu_read_unlock(); | ||
3641 | err = net_xmit_eval(err); | ||
3642 | } | ||
3643 | |||
3644 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c | ||
3645 | index 3a27cf762da1..bc532206077f 100644 | ||
3646 | --- a/net/ipv6/addrconf.c | ||
3647 | +++ b/net/ipv6/addrconf.c | ||
3648 | @@ -4068,7 +4068,6 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos) | ||
3649 | p++; | ||
3650 | continue; | ||
3651 | } | ||
3652 | - state->offset++; | ||
3653 | return ifa; | ||
3654 | } | ||
3655 | |||
3656 | @@ -4092,13 +4091,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq, | ||
3657 | return ifa; | ||
3658 | } | ||
3659 | |||
3660 | + state->offset = 0; | ||
3661 | while (++state->bucket < IN6_ADDR_HSIZE) { | ||
3662 | - state->offset = 0; | ||
3663 | hlist_for_each_entry_rcu_bh(ifa, | ||
3664 | &inet6_addr_lst[state->bucket], addr_lst) { | ||
3665 | if (!net_eq(dev_net(ifa->idev->dev), net)) | ||
3666 | continue; | ||
3667 | - state->offset++; | ||
3668 | return ifa; | ||
3669 | } | ||
3670 | } | ||
3671 | diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c | ||
3672 | index cda63426eefb..fd081a14064e 100644 | ||
3673 | --- a/net/ipv6/ip6_tunnel.c | ||
3674 | +++ b/net/ipv6/ip6_tunnel.c | ||
3675 | @@ -1226,7 +1226,7 @@ static inline int | ||
3676 | ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) | ||
3677 | { | ||
3678 | struct ip6_tnl *t = netdev_priv(dev); | ||
3679 | - const struct iphdr *iph = ip_hdr(skb); | ||
3680 | + const struct iphdr *iph; | ||
3681 | int encap_limit = -1; | ||
3682 | struct flowi6 fl6; | ||
3683 | __u8 dsfield; | ||
3684 | @@ -1234,6 +1234,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) | ||
3685 | u8 tproto; | ||
3686 | int err; | ||
3687 | |||
3688 | + /* ensure we can access the full inner ip header */ | ||
3689 | + if (!pskb_may_pull(skb, sizeof(struct iphdr))) | ||
3690 | + return -1; | ||
3691 | + | ||
3692 | + iph = ip_hdr(skb); | ||
3693 | memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); | ||
3694 | |||
3695 | tproto = ACCESS_ONCE(t->parms.proto); | ||
3696 | @@ -1293,7 +1298,7 @@ static inline int | ||
3697 | ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) | ||
3698 | { | ||
3699 | struct ip6_tnl *t = netdev_priv(dev); | ||
3700 | - struct ipv6hdr *ipv6h = ipv6_hdr(skb); | ||
3701 | + struct ipv6hdr *ipv6h; | ||
3702 | int encap_limit = -1; | ||
3703 | __u16 offset; | ||
3704 | struct flowi6 fl6; | ||
3705 | @@ -1302,6 +1307,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) | ||
3706 | u8 tproto; | ||
3707 | int err; | ||
3708 | |||
3709 | + if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h)))) | ||
3710 | + return -1; | ||
3711 | + | ||
3712 | + ipv6h = ipv6_hdr(skb); | ||
3713 | tproto = ACCESS_ONCE(t->parms.proto); | ||
3714 | if ((tproto != IPPROTO_IPV6 && tproto != 0) || | ||
3715 | ip6_tnl_addr_conflict(t, ipv6h)) | ||
3716 | diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c | ||
3717 | index ee33a6743f3b..b9147558a8f2 100644 | ||
3718 | --- a/net/ipv6/netfilter/nf_conntrack_reasm.c | ||
3719 | +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c | ||
3720 | @@ -63,7 +63,6 @@ struct nf_ct_frag6_skb_cb | ||
3721 | static struct inet_frags nf_frags; | ||
3722 | |||
3723 | #ifdef CONFIG_SYSCTL | ||
3724 | -static int zero; | ||
3725 | |||
3726 | static struct ctl_table nf_ct_frag6_sysctl_table[] = { | ||
3727 | { | ||
3728 | @@ -76,18 +75,17 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { | ||
3729 | { | ||
3730 | .procname = "nf_conntrack_frag6_low_thresh", | ||
3731 | .data = &init_net.nf_frag.frags.low_thresh, | ||
3732 | - .maxlen = sizeof(unsigned int), | ||
3733 | + .maxlen = sizeof(unsigned long), | ||
3734 | .mode = 0644, | ||
3735 | - .proc_handler = proc_dointvec_minmax, | ||
3736 | - .extra1 = &zero, | ||
3737 | + .proc_handler = proc_doulongvec_minmax, | ||
3738 | .extra2 = &init_net.nf_frag.frags.high_thresh | ||
3739 | }, | ||
3740 | { | ||
3741 | .procname = "nf_conntrack_frag6_high_thresh", | ||
3742 | .data = &init_net.nf_frag.frags.high_thresh, | ||
3743 | - .maxlen = sizeof(unsigned int), | ||
3744 | + .maxlen = sizeof(unsigned long), | ||
3745 | .mode = 0644, | ||
3746 | - .proc_handler = proc_dointvec_minmax, | ||
3747 | + .proc_handler = proc_doulongvec_minmax, | ||
3748 | .extra1 = &init_net.nf_frag.frags.low_thresh | ||
3749 | }, | ||
3750 | { } | ||
3751 | @@ -152,23 +150,6 @@ static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h) | ||
3752 | return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK); | ||
3753 | } | ||
3754 | |||
3755 | -static unsigned int nf_hash_frag(__be32 id, const struct in6_addr *saddr, | ||
3756 | - const struct in6_addr *daddr) | ||
3757 | -{ | ||
3758 | - net_get_random_once(&nf_frags.rnd, sizeof(nf_frags.rnd)); | ||
3759 | - return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), | ||
3760 | - (__force u32)id, nf_frags.rnd); | ||
3761 | -} | ||
3762 | - | ||
3763 | - | ||
3764 | -static unsigned int nf_hashfn(const struct inet_frag_queue *q) | ||
3765 | -{ | ||
3766 | - const struct frag_queue *nq; | ||
3767 | - | ||
3768 | - nq = container_of(q, struct frag_queue, q); | ||
3769 | - return nf_hash_frag(nq->id, &nq->saddr, &nq->daddr); | ||
3770 | -} | ||
3771 | - | ||
3772 | static void nf_ct_frag6_expire(unsigned long data) | ||
3773 | { | ||
3774 | struct frag_queue *fq; | ||
3775 | @@ -177,34 +158,26 @@ static void nf_ct_frag6_expire(unsigned long data) | ||
3776 | fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); | ||
3777 | net = container_of(fq->q.net, struct net, nf_frag.frags); | ||
3778 | |||
3779 | - ip6_expire_frag_queue(net, fq, &nf_frags); | ||
3780 | + ip6_expire_frag_queue(net, fq); | ||
3781 | } | ||
3782 | |||
3783 | /* Creation primitives. */ | ||
3784 | -static inline struct frag_queue *fq_find(struct net *net, __be32 id, | ||
3785 | - u32 user, struct in6_addr *src, | ||
3786 | - struct in6_addr *dst, int iif, u8 ecn) | ||
3787 | +static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user, | ||
3788 | + const struct ipv6hdr *hdr, int iif) | ||
3789 | { | ||
3790 | + struct frag_v6_compare_key key = { | ||
3791 | + .id = id, | ||
3792 | + .saddr = hdr->saddr, | ||
3793 | + .daddr = hdr->daddr, | ||
3794 | + .user = user, | ||
3795 | + .iif = iif, | ||
3796 | + }; | ||
3797 | struct inet_frag_queue *q; | ||
3798 | - struct ip6_create_arg arg; | ||
3799 | - unsigned int hash; | ||
3800 | - | ||
3801 | - arg.id = id; | ||
3802 | - arg.user = user; | ||
3803 | - arg.src = src; | ||
3804 | - arg.dst = dst; | ||
3805 | - arg.iif = iif; | ||
3806 | - arg.ecn = ecn; | ||
3807 | - | ||
3808 | - local_bh_disable(); | ||
3809 | - hash = nf_hash_frag(id, src, dst); | ||
3810 | - | ||
3811 | - q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash); | ||
3812 | - local_bh_enable(); | ||
3813 | - if (IS_ERR_OR_NULL(q)) { | ||
3814 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); | ||
3815 | + | ||
3816 | + q = inet_frag_find(&net->nf_frag.frags, &key); | ||
3817 | + if (!q) | ||
3818 | return NULL; | ||
3819 | - } | ||
3820 | + | ||
3821 | return container_of(q, struct frag_queue, q); | ||
3822 | } | ||
3823 | |||
3824 | @@ -263,7 +236,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, | ||
3825 | * this case. -DaveM | ||
3826 | */ | ||
3827 | pr_debug("end of fragment not rounded to 8 bytes.\n"); | ||
3828 | - inet_frag_kill(&fq->q, &nf_frags); | ||
3829 | + inet_frag_kill(&fq->q); | ||
3830 | return -EPROTO; | ||
3831 | } | ||
3832 | if (end > fq->q.len) { | ||
3833 | @@ -356,7 +329,7 @@ found: | ||
3834 | return 0; | ||
3835 | |||
3836 | discard_fq: | ||
3837 | - inet_frag_kill(&fq->q, &nf_frags); | ||
3838 | + inet_frag_kill(&fq->q); | ||
3839 | err: | ||
3840 | return -EINVAL; | ||
3841 | } | ||
3842 | @@ -378,7 +351,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic | ||
3843 | int payload_len; | ||
3844 | u8 ecn; | ||
3845 | |||
3846 | - inet_frag_kill(&fq->q, &nf_frags); | ||
3847 | + inet_frag_kill(&fq->q); | ||
3848 | |||
3849 | WARN_ON(head == NULL); | ||
3850 | WARN_ON(NFCT_FRAG6_CB(head)->offset != 0); | ||
3851 | @@ -479,6 +452,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic | ||
3852 | else if (head->ip_summed == CHECKSUM_COMPLETE) | ||
3853 | head->csum = csum_add(head->csum, fp->csum); | ||
3854 | head->truesize += fp->truesize; | ||
3855 | + fp->sk = NULL; | ||
3856 | } | ||
3857 | sub_frag_mem_limit(fq->q.net, head->truesize); | ||
3858 | |||
3859 | @@ -497,6 +471,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic | ||
3860 | head->csum); | ||
3861 | |||
3862 | fq->q.fragments = NULL; | ||
3863 | + fq->q.rb_fragments = RB_ROOT; | ||
3864 | fq->q.fragments_tail = NULL; | ||
3865 | |||
3866 | return true; | ||
3867 | @@ -591,9 +566,13 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) | ||
3868 | hdr = ipv6_hdr(skb); | ||
3869 | fhdr = (struct frag_hdr *)skb_transport_header(skb); | ||
3870 | |||
3871 | + if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && | ||
3872 | + fhdr->frag_off & htons(IP6_MF)) | ||
3873 | + return -EINVAL; | ||
3874 | + | ||
3875 | skb_orphan(skb); | ||
3876 | - fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr, | ||
3877 | - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); | ||
3878 | + fq = fq_find(net, fhdr->identification, user, hdr, | ||
3879 | + skb->dev ? skb->dev->ifindex : 0); | ||
3880 | if (fq == NULL) { | ||
3881 | pr_debug("Can't find and can't create new queue\n"); | ||
3882 | return -ENOMEM; | ||
3883 | @@ -623,25 +602,33 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) | ||
3884 | |||
3885 | out_unlock: | ||
3886 | spin_unlock_bh(&fq->q.lock); | ||
3887 | - inet_frag_put(&fq->q, &nf_frags); | ||
3888 | + inet_frag_put(&fq->q); | ||
3889 | return ret; | ||
3890 | } | ||
3891 | EXPORT_SYMBOL_GPL(nf_ct_frag6_gather); | ||
3892 | |||
3893 | static int nf_ct_net_init(struct net *net) | ||
3894 | { | ||
3895 | + int res; | ||
3896 | + | ||
3897 | net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; | ||
3898 | net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH; | ||
3899 | net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT; | ||
3900 | - inet_frags_init_net(&net->nf_frag.frags); | ||
3901 | - | ||
3902 | - return nf_ct_frag6_sysctl_register(net); | ||
3903 | + net->nf_frag.frags.f = &nf_frags; | ||
3904 | + | ||
3905 | + res = inet_frags_init_net(&net->nf_frag.frags); | ||
3906 | + if (res < 0) | ||
3907 | + return res; | ||
3908 | + res = nf_ct_frag6_sysctl_register(net); | ||
3909 | + if (res < 0) | ||
3910 | + inet_frags_exit_net(&net->nf_frag.frags); | ||
3911 | + return res; | ||
3912 | } | ||
3913 | |||
3914 | static void nf_ct_net_exit(struct net *net) | ||
3915 | { | ||
3916 | nf_ct_frags6_sysctl_unregister(net); | ||
3917 | - inet_frags_exit_net(&net->nf_frag.frags, &nf_frags); | ||
3918 | + inet_frags_exit_net(&net->nf_frag.frags); | ||
3919 | } | ||
3920 | |||
3921 | static struct pernet_operations nf_ct_net_ops = { | ||
3922 | @@ -653,13 +640,12 @@ int nf_ct_frag6_init(void) | ||
3923 | { | ||
3924 | int ret = 0; | ||
3925 | |||
3926 | - nf_frags.hashfn = nf_hashfn; | ||
3927 | nf_frags.constructor = ip6_frag_init; | ||
3928 | nf_frags.destructor = NULL; | ||
3929 | nf_frags.qsize = sizeof(struct frag_queue); | ||
3930 | - nf_frags.match = ip6_frag_match; | ||
3931 | nf_frags.frag_expire = nf_ct_frag6_expire; | ||
3932 | nf_frags.frags_cache_name = nf_frags_cache_name; | ||
3933 | + nf_frags.rhash_params = ip6_rhash_params; | ||
3934 | ret = inet_frags_init(&nf_frags); | ||
3935 | if (ret) | ||
3936 | goto out; | ||
3937 | diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c | ||
3938 | index e88bcb8ff0fd..dc04c024986c 100644 | ||
3939 | --- a/net/ipv6/proc.c | ||
3940 | +++ b/net/ipv6/proc.c | ||
3941 | @@ -38,7 +38,6 @@ | ||
3942 | static int sockstat6_seq_show(struct seq_file *seq, void *v) | ||
3943 | { | ||
3944 | struct net *net = seq->private; | ||
3945 | - unsigned int frag_mem = ip6_frag_mem(net); | ||
3946 | |||
3947 | seq_printf(seq, "TCP6: inuse %d\n", | ||
3948 | sock_prot_inuse_get(net, &tcpv6_prot)); | ||
3949 | @@ -48,7 +47,9 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v) | ||
3950 | sock_prot_inuse_get(net, &udplitev6_prot)); | ||
3951 | seq_printf(seq, "RAW6: inuse %d\n", | ||
3952 | sock_prot_inuse_get(net, &rawv6_prot)); | ||
3953 | - seq_printf(seq, "FRAG6: inuse %u memory %u\n", !!frag_mem, frag_mem); | ||
3954 | + seq_printf(seq, "FRAG6: inuse %u memory %lu\n", | ||
3955 | + atomic_read(&net->ipv6.frags.rhashtable.nelems), | ||
3956 | + frag_mem_limit(&net->ipv6.frags)); | ||
3957 | return 0; | ||
3958 | } | ||
3959 | |||
3960 | diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c | ||
3961 | index 71ffa526cb23..a4f979ff31b9 100644 | ||
3962 | --- a/net/ipv6/raw.c | ||
3963 | +++ b/net/ipv6/raw.c | ||
3964 | @@ -645,8 +645,6 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, | ||
3965 | skb->protocol = htons(ETH_P_IPV6); | ||
3966 | skb->priority = sk->sk_priority; | ||
3967 | skb->mark = sk->sk_mark; | ||
3968 | - skb_dst_set(skb, &rt->dst); | ||
3969 | - *dstp = NULL; | ||
3970 | |||
3971 | skb_put(skb, length); | ||
3972 | skb_reset_network_header(skb); | ||
3973 | @@ -656,8 +654,14 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, | ||
3974 | |||
3975 | skb->transport_header = skb->network_header; | ||
3976 | err = memcpy_from_msg(iph, msg, length); | ||
3977 | - if (err) | ||
3978 | - goto error_fault; | ||
3979 | + if (err) { | ||
3980 | + err = -EFAULT; | ||
3981 | + kfree_skb(skb); | ||
3982 | + goto error; | ||
3983 | + } | ||
3984 | + | ||
3985 | + skb_dst_set(skb, &rt->dst); | ||
3986 | + *dstp = NULL; | ||
3987 | |||
3988 | /* if egress device is enslaved to an L3 master device pass the | ||
3989 | * skb to its handler for processing | ||
3990 | @@ -666,21 +670,28 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, | ||
3991 | if (unlikely(!skb)) | ||
3992 | return 0; | ||
3993 | |||
3994 | + /* Acquire rcu_read_lock() in case we need to use rt->rt6i_idev | ||
3995 | + * in the error path. Since skb has been freed, the dst could | ||
3996 | + * have been queued for deletion. | ||
3997 | + */ | ||
3998 | + rcu_read_lock(); | ||
3999 | IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len); | ||
4000 | err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk, skb, | ||
4001 | NULL, rt->dst.dev, dst_output); | ||
4002 | if (err > 0) | ||
4003 | err = net_xmit_errno(err); | ||
4004 | - if (err) | ||
4005 | - goto error; | ||
4006 | + if (err) { | ||
4007 | + IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); | ||
4008 | + rcu_read_unlock(); | ||
4009 | + goto error_check; | ||
4010 | + } | ||
4011 | + rcu_read_unlock(); | ||
4012 | out: | ||
4013 | return 0; | ||
4014 | |||
4015 | -error_fault: | ||
4016 | - err = -EFAULT; | ||
4017 | - kfree_skb(skb); | ||
4018 | error: | ||
4019 | IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); | ||
4020 | +error_check: | ||
4021 | if (err == -ENOBUFS && !np->recverr) | ||
4022 | err = 0; | ||
4023 | return err; | ||
4024 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c | ||
4025 | index e585c0a2591c..74ffbcb306a6 100644 | ||
4026 | --- a/net/ipv6/reassembly.c | ||
4027 | +++ b/net/ipv6/reassembly.c | ||
4028 | @@ -79,94 +79,58 @@ static struct inet_frags ip6_frags; | ||
4029 | static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, | ||
4030 | struct net_device *dev); | ||
4031 | |||
4032 | -/* | ||
4033 | - * callers should be careful not to use the hash value outside the ipfrag_lock | ||
4034 | - * as doing so could race with ipfrag_hash_rnd being recalculated. | ||
4035 | - */ | ||
4036 | -static unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr, | ||
4037 | - const struct in6_addr *daddr) | ||
4038 | -{ | ||
4039 | - net_get_random_once(&ip6_frags.rnd, sizeof(ip6_frags.rnd)); | ||
4040 | - return jhash_3words(ipv6_addr_hash(saddr), ipv6_addr_hash(daddr), | ||
4041 | - (__force u32)id, ip6_frags.rnd); | ||
4042 | -} | ||
4043 | - | ||
4044 | -static unsigned int ip6_hashfn(const struct inet_frag_queue *q) | ||
4045 | -{ | ||
4046 | - const struct frag_queue *fq; | ||
4047 | - | ||
4048 | - fq = container_of(q, struct frag_queue, q); | ||
4049 | - return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr); | ||
4050 | -} | ||
4051 | - | ||
4052 | -bool ip6_frag_match(const struct inet_frag_queue *q, const void *a) | ||
4053 | -{ | ||
4054 | - const struct frag_queue *fq; | ||
4055 | - const struct ip6_create_arg *arg = a; | ||
4056 | - | ||
4057 | - fq = container_of(q, struct frag_queue, q); | ||
4058 | - return fq->id == arg->id && | ||
4059 | - fq->user == arg->user && | ||
4060 | - ipv6_addr_equal(&fq->saddr, arg->src) && | ||
4061 | - ipv6_addr_equal(&fq->daddr, arg->dst) && | ||
4062 | - (arg->iif == fq->iif || | ||
4063 | - !(ipv6_addr_type(arg->dst) & (IPV6_ADDR_MULTICAST | | ||
4064 | - IPV6_ADDR_LINKLOCAL))); | ||
4065 | -} | ||
4066 | -EXPORT_SYMBOL(ip6_frag_match); | ||
4067 | - | ||
4068 | void ip6_frag_init(struct inet_frag_queue *q, const void *a) | ||
4069 | { | ||
4070 | struct frag_queue *fq = container_of(q, struct frag_queue, q); | ||
4071 | - const struct ip6_create_arg *arg = a; | ||
4072 | + const struct frag_v6_compare_key *key = a; | ||
4073 | |||
4074 | - fq->id = arg->id; | ||
4075 | - fq->user = arg->user; | ||
4076 | - fq->saddr = *arg->src; | ||
4077 | - fq->daddr = *arg->dst; | ||
4078 | - fq->ecn = arg->ecn; | ||
4079 | + q->key.v6 = *key; | ||
4080 | + fq->ecn = 0; | ||
4081 | } | ||
4082 | EXPORT_SYMBOL(ip6_frag_init); | ||
4083 | |||
4084 | -void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq, | ||
4085 | - struct inet_frags *frags) | ||
4086 | +void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq) | ||
4087 | { | ||
4088 | struct net_device *dev = NULL; | ||
4089 | + struct sk_buff *head; | ||
4090 | |||
4091 | + rcu_read_lock(); | ||
4092 | spin_lock(&fq->q.lock); | ||
4093 | |||
4094 | if (fq->q.flags & INET_FRAG_COMPLETE) | ||
4095 | goto out; | ||
4096 | |||
4097 | - inet_frag_kill(&fq->q, frags); | ||
4098 | + inet_frag_kill(&fq->q); | ||
4099 | |||
4100 | - rcu_read_lock(); | ||
4101 | dev = dev_get_by_index_rcu(net, fq->iif); | ||
4102 | if (!dev) | ||
4103 | - goto out_rcu_unlock; | ||
4104 | + goto out; | ||
4105 | |||
4106 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS); | ||
4107 | - | ||
4108 | - if (inet_frag_evicting(&fq->q)) | ||
4109 | - goto out_rcu_unlock; | ||
4110 | - | ||
4111 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT); | ||
4112 | |||
4113 | /* Don't send error if the first segment did not arrive. */ | ||
4114 | - if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !fq->q.fragments) | ||
4115 | - goto out_rcu_unlock; | ||
4116 | + head = fq->q.fragments; | ||
4117 | + if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !head) | ||
4118 | + goto out; | ||
4119 | |||
4120 | /* But use as source device on which LAST ARRIVED | ||
4121 | * segment was received. And do not use fq->dev | ||
4122 | * pointer directly, device might already disappeared. | ||
4123 | */ | ||
4124 | - fq->q.fragments->dev = dev; | ||
4125 | - icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); | ||
4126 | -out_rcu_unlock: | ||
4127 | - rcu_read_unlock(); | ||
4128 | + head->dev = dev; | ||
4129 | + skb_get(head); | ||
4130 | + spin_unlock(&fq->q.lock); | ||
4131 | + | ||
4132 | + icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0); | ||
4133 | + kfree_skb(head); | ||
4134 | + goto out_rcu_unlock; | ||
4135 | + | ||
4136 | out: | ||
4137 | spin_unlock(&fq->q.lock); | ||
4138 | - inet_frag_put(&fq->q, frags); | ||
4139 | +out_rcu_unlock: | ||
4140 | + rcu_read_unlock(); | ||
4141 | + inet_frag_put(&fq->q); | ||
4142 | } | ||
4143 | EXPORT_SYMBOL(ip6_expire_frag_queue); | ||
4144 | |||
4145 | @@ -178,31 +142,29 @@ static void ip6_frag_expire(unsigned long data) | ||
4146 | fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q); | ||
4147 | net = container_of(fq->q.net, struct net, ipv6.frags); | ||
4148 | |||
4149 | - ip6_expire_frag_queue(net, fq, &ip6_frags); | ||
4150 | + ip6_expire_frag_queue(net, fq); | ||
4151 | } | ||
4152 | |||
4153 | static struct frag_queue * | ||
4154 | -fq_find(struct net *net, __be32 id, const struct in6_addr *src, | ||
4155 | - const struct in6_addr *dst, int iif, u8 ecn) | ||
4156 | +fq_find(struct net *net, __be32 id, const struct ipv6hdr *hdr, int iif) | ||
4157 | { | ||
4158 | + struct frag_v6_compare_key key = { | ||
4159 | + .id = id, | ||
4160 | + .saddr = hdr->saddr, | ||
4161 | + .daddr = hdr->daddr, | ||
4162 | + .user = IP6_DEFRAG_LOCAL_DELIVER, | ||
4163 | + .iif = iif, | ||
4164 | + }; | ||
4165 | struct inet_frag_queue *q; | ||
4166 | - struct ip6_create_arg arg; | ||
4167 | - unsigned int hash; | ||
4168 | |||
4169 | - arg.id = id; | ||
4170 | - arg.user = IP6_DEFRAG_LOCAL_DELIVER; | ||
4171 | - arg.src = src; | ||
4172 | - arg.dst = dst; | ||
4173 | - arg.iif = iif; | ||
4174 | - arg.ecn = ecn; | ||
4175 | + if (!(ipv6_addr_type(&hdr->daddr) & (IPV6_ADDR_MULTICAST | | ||
4176 | + IPV6_ADDR_LINKLOCAL))) | ||
4177 | + key.iif = 0; | ||
4178 | |||
4179 | - hash = inet6_hash_frag(id, src, dst); | ||
4180 | - | ||
4181 | - q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash); | ||
4182 | - if (IS_ERR_OR_NULL(q)) { | ||
4183 | - inet_frag_maybe_warn_overflow(q, pr_fmt()); | ||
4184 | + q = inet_frag_find(&net->ipv6.frags, &key); | ||
4185 | + if (!q) | ||
4186 | return NULL; | ||
4187 | - } | ||
4188 | + | ||
4189 | return container_of(q, struct frag_queue, q); | ||
4190 | } | ||
4191 | |||
4192 | @@ -359,7 +321,7 @@ found: | ||
4193 | return -1; | ||
4194 | |||
4195 | discard_fq: | ||
4196 | - inet_frag_kill(&fq->q, &ip6_frags); | ||
4197 | + inet_frag_kill(&fq->q); | ||
4198 | err: | ||
4199 | __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), | ||
4200 | IPSTATS_MIB_REASMFAILS); | ||
4201 | @@ -386,7 +348,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, | ||
4202 | int sum_truesize; | ||
4203 | u8 ecn; | ||
4204 | |||
4205 | - inet_frag_kill(&fq->q, &ip6_frags); | ||
4206 | + inet_frag_kill(&fq->q); | ||
4207 | |||
4208 | ecn = ip_frag_ecn_table[fq->ecn]; | ||
4209 | if (unlikely(ecn == 0xff)) | ||
4210 | @@ -504,6 +466,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, | ||
4211 | __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS); | ||
4212 | rcu_read_unlock(); | ||
4213 | fq->q.fragments = NULL; | ||
4214 | + fq->q.rb_fragments = RB_ROOT; | ||
4215 | fq->q.fragments_tail = NULL; | ||
4216 | return 1; | ||
4217 | |||
4218 | @@ -525,6 +488,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) | ||
4219 | struct frag_queue *fq; | ||
4220 | const struct ipv6hdr *hdr = ipv6_hdr(skb); | ||
4221 | struct net *net = dev_net(skb_dst(skb)->dev); | ||
4222 | + int iif; | ||
4223 | |||
4224 | if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED) | ||
4225 | goto fail_hdr; | ||
4226 | @@ -553,17 +517,22 @@ static int ipv6_frag_rcv(struct sk_buff *skb) | ||
4227 | return 1; | ||
4228 | } | ||
4229 | |||
4230 | - fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, | ||
4231 | - skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); | ||
4232 | + if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU && | ||
4233 | + fhdr->frag_off & htons(IP6_MF)) | ||
4234 | + goto fail_hdr; | ||
4235 | + | ||
4236 | + iif = skb->dev ? skb->dev->ifindex : 0; | ||
4237 | + fq = fq_find(net, fhdr->identification, hdr, iif); | ||
4238 | if (fq) { | ||
4239 | int ret; | ||
4240 | |||
4241 | spin_lock(&fq->q.lock); | ||
4242 | |||
4243 | + fq->iif = iif; | ||
4244 | ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff); | ||
4245 | |||
4246 | spin_unlock(&fq->q.lock); | ||
4247 | - inet_frag_put(&fq->q, &ip6_frags); | ||
4248 | + inet_frag_put(&fq->q); | ||
4249 | return ret; | ||
4250 | } | ||
4251 | |||
4252 | @@ -584,24 +553,22 @@ static const struct inet6_protocol frag_protocol = { | ||
4253 | }; | ||
4254 | |||
4255 | #ifdef CONFIG_SYSCTL | ||
4256 | -static int zero; | ||
4257 | |||
4258 | static struct ctl_table ip6_frags_ns_ctl_table[] = { | ||
4259 | { | ||
4260 | .procname = "ip6frag_high_thresh", | ||
4261 | .data = &init_net.ipv6.frags.high_thresh, | ||
4262 | - .maxlen = sizeof(int), | ||
4263 | + .maxlen = sizeof(unsigned long), | ||
4264 | .mode = 0644, | ||
4265 | - .proc_handler = proc_dointvec_minmax, | ||
4266 | + .proc_handler = proc_doulongvec_minmax, | ||
4267 | .extra1 = &init_net.ipv6.frags.low_thresh | ||
4268 | }, | ||
4269 | { | ||
4270 | .procname = "ip6frag_low_thresh", | ||
4271 | .data = &init_net.ipv6.frags.low_thresh, | ||
4272 | - .maxlen = sizeof(int), | ||
4273 | + .maxlen = sizeof(unsigned long), | ||
4274 | .mode = 0644, | ||
4275 | - .proc_handler = proc_dointvec_minmax, | ||
4276 | - .extra1 = &zero, | ||
4277 | + .proc_handler = proc_doulongvec_minmax, | ||
4278 | .extra2 = &init_net.ipv6.frags.high_thresh | ||
4279 | }, | ||
4280 | { | ||
4281 | @@ -644,10 +611,6 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net) | ||
4282 | table[1].data = &net->ipv6.frags.low_thresh; | ||
4283 | table[1].extra2 = &net->ipv6.frags.high_thresh; | ||
4284 | table[2].data = &net->ipv6.frags.timeout; | ||
4285 | - | ||
4286 | - /* Don't export sysctls to unprivileged users */ | ||
4287 | - if (net->user_ns != &init_user_ns) | ||
4288 | - table[0].procname = NULL; | ||
4289 | } | ||
4290 | |||
4291 | hdr = register_net_sysctl(net, "net/ipv6", table); | ||
4292 | @@ -709,19 +672,27 @@ static void ip6_frags_sysctl_unregister(void) | ||
4293 | |||
4294 | static int __net_init ipv6_frags_init_net(struct net *net) | ||
4295 | { | ||
4296 | + int res; | ||
4297 | + | ||
4298 | net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; | ||
4299 | net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH; | ||
4300 | net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; | ||
4301 | + net->ipv6.frags.f = &ip6_frags; | ||
4302 | |||
4303 | - inet_frags_init_net(&net->ipv6.frags); | ||
4304 | + res = inet_frags_init_net(&net->ipv6.frags); | ||
4305 | + if (res < 0) | ||
4306 | + return res; | ||
4307 | |||
4308 | - return ip6_frags_ns_sysctl_register(net); | ||
4309 | + res = ip6_frags_ns_sysctl_register(net); | ||
4310 | + if (res < 0) | ||
4311 | + inet_frags_exit_net(&net->ipv6.frags); | ||
4312 | + return res; | ||
4313 | } | ||
4314 | |||
4315 | static void __net_exit ipv6_frags_exit_net(struct net *net) | ||
4316 | { | ||
4317 | ip6_frags_ns_sysctl_unregister(net); | ||
4318 | - inet_frags_exit_net(&net->ipv6.frags, &ip6_frags); | ||
4319 | + inet_frags_exit_net(&net->ipv6.frags); | ||
4320 | } | ||
4321 | |||
4322 | static struct pernet_operations ip6_frags_ops = { | ||
4323 | @@ -729,14 +700,55 @@ static struct pernet_operations ip6_frags_ops = { | ||
4324 | .exit = ipv6_frags_exit_net, | ||
4325 | }; | ||
4326 | |||
4327 | +static u32 ip6_key_hashfn(const void *data, u32 len, u32 seed) | ||
4328 | +{ | ||
4329 | + return jhash2(data, | ||
4330 | + sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); | ||
4331 | +} | ||
4332 | + | ||
4333 | +static u32 ip6_obj_hashfn(const void *data, u32 len, u32 seed) | ||
4334 | +{ | ||
4335 | + const struct inet_frag_queue *fq = data; | ||
4336 | + | ||
4337 | + return jhash2((const u32 *)&fq->key.v6, | ||
4338 | + sizeof(struct frag_v6_compare_key) / sizeof(u32), seed); | ||
4339 | +} | ||
4340 | + | ||
4341 | +static int ip6_obj_cmpfn(struct rhashtable_compare_arg *arg, const void *ptr) | ||
4342 | +{ | ||
4343 | + const struct frag_v6_compare_key *key = arg->key; | ||
4344 | + const struct inet_frag_queue *fq = ptr; | ||
4345 | + | ||
4346 | + return !!memcmp(&fq->key, key, sizeof(*key)); | ||
4347 | +} | ||
4348 | + | ||
4349 | +const struct rhashtable_params ip6_rhash_params = { | ||
4350 | + .head_offset = offsetof(struct inet_frag_queue, node), | ||
4351 | + .hashfn = ip6_key_hashfn, | ||
4352 | + .obj_hashfn = ip6_obj_hashfn, | ||
4353 | + .obj_cmpfn = ip6_obj_cmpfn, | ||
4354 | + .automatic_shrinking = true, | ||
4355 | +}; | ||
4356 | +EXPORT_SYMBOL(ip6_rhash_params); | ||
4357 | + | ||
4358 | int __init ipv6_frag_init(void) | ||
4359 | { | ||
4360 | int ret; | ||
4361 | |||
4362 | - ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); | ||
4363 | + ip6_frags.constructor = ip6_frag_init; | ||
4364 | + ip6_frags.destructor = NULL; | ||
4365 | + ip6_frags.qsize = sizeof(struct frag_queue); | ||
4366 | + ip6_frags.frag_expire = ip6_frag_expire; | ||
4367 | + ip6_frags.frags_cache_name = ip6_frag_cache_name; | ||
4368 | + ip6_frags.rhash_params = ip6_rhash_params; | ||
4369 | + ret = inet_frags_init(&ip6_frags); | ||
4370 | if (ret) | ||
4371 | goto out; | ||
4372 | |||
4373 | + ret = inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT); | ||
4374 | + if (ret) | ||
4375 | + goto err_protocol; | ||
4376 | + | ||
4377 | ret = ip6_frags_sysctl_register(); | ||
4378 | if (ret) | ||
4379 | goto err_sysctl; | ||
4380 | @@ -745,16 +757,6 @@ int __init ipv6_frag_init(void) | ||
4381 | if (ret) | ||
4382 | goto err_pernet; | ||
4383 | |||
4384 | - ip6_frags.hashfn = ip6_hashfn; | ||
4385 | - ip6_frags.constructor = ip6_frag_init; | ||
4386 | - ip6_frags.destructor = NULL; | ||
4387 | - ip6_frags.qsize = sizeof(struct frag_queue); | ||
4388 | - ip6_frags.match = ip6_frag_match; | ||
4389 | - ip6_frags.frag_expire = ip6_frag_expire; | ||
4390 | - ip6_frags.frags_cache_name = ip6_frag_cache_name; | ||
4391 | - ret = inet_frags_init(&ip6_frags); | ||
4392 | - if (ret) | ||
4393 | - goto err_pernet; | ||
4394 | out: | ||
4395 | return ret; | ||
4396 | |||
4397 | @@ -762,6 +764,8 @@ err_pernet: | ||
4398 | ip6_frags_sysctl_unregister(); | ||
4399 | err_sysctl: | ||
4400 | inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); | ||
4401 | +err_protocol: | ||
4402 | + inet_frags_fini(&ip6_frags); | ||
4403 | goto out; | ||
4404 | } | ||
4405 | |||
4406 | diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c | ||
4407 | index a123d0dc1ef9..053ba8646155 100644 | ||
4408 | --- a/net/netlabel/netlabel_unlabeled.c | ||
4409 | +++ b/net/netlabel/netlabel_unlabeled.c | ||
4410 | @@ -787,7 +787,8 @@ static int netlbl_unlabel_addrinfo_get(struct genl_info *info, | ||
4411 | { | ||
4412 | u32 addr_len; | ||
4413 | |||
4414 | - if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { | ||
4415 | + if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] && | ||
4416 | + info->attrs[NLBL_UNLABEL_A_IPV4MASK]) { | ||
4417 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); | ||
4418 | if (addr_len != sizeof(struct in_addr) && | ||
4419 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) | ||
4420 | diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c | ||
4421 | index 8761877207ec..00c6af2ae1c2 100644 | ||
4422 | --- a/sound/hda/hdac_controller.c | ||
4423 | +++ b/sound/hda/hdac_controller.c | ||
4424 | @@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac_bus *bus) | ||
4425 | */ | ||
4426 | void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus) | ||
4427 | { | ||
4428 | + WARN_ON_ONCE(!bus->rb.area); | ||
4429 | + | ||
4430 | spin_lock_irq(&bus->reg_lock); | ||
4431 | /* CORB set up */ | ||
4432 | bus->corb.addr = bus->rb.addr; | ||
4433 | @@ -478,13 +480,15 @@ bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset) | ||
4434 | /* reset controller */ | ||
4435 | azx_reset(bus, full_reset); | ||
4436 | |||
4437 | - /* initialize interrupts */ | ||
4438 | + /* clear interrupts */ | ||
4439 | azx_int_clear(bus); | ||
4440 | - azx_int_enable(bus); | ||
4441 | |||
4442 | /* initialize the codec command I/O */ | ||
4443 | snd_hdac_bus_init_cmd_io(bus); | ||
4444 | |||
4445 | + /* enable interrupts after CORB/RIRB buffers are initialized above */ | ||
4446 | + azx_int_enable(bus); | ||
4447 | + | ||
4448 | /* program the position buffer */ | ||
4449 | if (bus->use_posbuf && bus->posbuf.addr) { | ||
4450 | snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr); | ||
4451 | diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c | ||
4452 | index d53680ac78e4..6df158669420 100644 | ||
4453 | --- a/sound/soc/codecs/sigmadsp.c | ||
4454 | +++ b/sound/soc/codecs/sigmadsp.c | ||
4455 | @@ -117,8 +117,7 @@ static int sigmadsp_ctrl_write(struct sigmadsp *sigmadsp, | ||
4456 | struct sigmadsp_control *ctrl, void *data) | ||
4457 | { | ||
4458 | /* safeload loads up to 20 bytes in a atomic operation */ | ||
4459 | - if (ctrl->num_bytes > 4 && ctrl->num_bytes <= 20 && sigmadsp->ops && | ||
4460 | - sigmadsp->ops->safeload) | ||
4461 | + if (ctrl->num_bytes <= 20 && sigmadsp->ops && sigmadsp->ops->safeload) | ||
4462 | return sigmadsp->ops->safeload(sigmadsp, ctrl->addr, data, | ||
4463 | ctrl->num_bytes); | ||
4464 | else | ||
4465 | diff --git a/sound/soc/codecs/wm8804-i2c.c b/sound/soc/codecs/wm8804-i2c.c | ||
4466 | index f27464c2c5ba..79541960f45d 100644 | ||
4467 | --- a/sound/soc/codecs/wm8804-i2c.c | ||
4468 | +++ b/sound/soc/codecs/wm8804-i2c.c | ||
4469 | @@ -13,6 +13,7 @@ | ||
4470 | #include <linux/init.h> | ||
4471 | #include <linux/module.h> | ||
4472 | #include <linux/i2c.h> | ||
4473 | +#include <linux/acpi.h> | ||
4474 | |||
4475 | #include "wm8804.h" | ||
4476 | |||
4477 | @@ -40,17 +41,29 @@ static const struct i2c_device_id wm8804_i2c_id[] = { | ||
4478 | }; | ||
4479 | MODULE_DEVICE_TABLE(i2c, wm8804_i2c_id); | ||
4480 | |||
4481 | +#if defined(CONFIG_OF) | ||
4482 | static const struct of_device_id wm8804_of_match[] = { | ||
4483 | { .compatible = "wlf,wm8804", }, | ||
4484 | { } | ||
4485 | }; | ||
4486 | MODULE_DEVICE_TABLE(of, wm8804_of_match); | ||
4487 | +#endif | ||
4488 | + | ||
4489 | +#ifdef CONFIG_ACPI | ||
4490 | +static const struct acpi_device_id wm8804_acpi_match[] = { | ||
4491 | + { "1AEC8804", 0 }, /* Wolfson PCI ID + part ID */ | ||
4492 | + { "10138804", 0 }, /* Cirrus Logic PCI ID + part ID */ | ||
4493 | + { }, | ||
4494 | +}; | ||
4495 | +MODULE_DEVICE_TABLE(acpi, wm8804_acpi_match); | ||
4496 | +#endif | ||
4497 | |||
4498 | static struct i2c_driver wm8804_i2c_driver = { | ||
4499 | .driver = { | ||
4500 | .name = "wm8804", | ||
4501 | .pm = &wm8804_pm, | ||
4502 | - .of_match_table = wm8804_of_match, | ||
4503 | + .of_match_table = of_match_ptr(wm8804_of_match), | ||
4504 | + .acpi_match_table = ACPI_PTR(wm8804_acpi_match), | ||
4505 | }, | ||
4506 | .probe = wm8804_i2c_probe, | ||
4507 | .remove = wm8804_i2c_remove, | ||
4508 | diff --git a/tools/perf/scripts/python/export-to-postgresql.py b/tools/perf/scripts/python/export-to-postgresql.py | ||
4509 | index 7656ff8aa066..c001d5a91d22 100644 | ||
4510 | --- a/tools/perf/scripts/python/export-to-postgresql.py | ||
4511 | +++ b/tools/perf/scripts/python/export-to-postgresql.py | ||
4512 | @@ -204,14 +204,23 @@ from ctypes import * | ||
4513 | libpq = CDLL("libpq.so.5") | ||
4514 | PQconnectdb = libpq.PQconnectdb | ||
4515 | PQconnectdb.restype = c_void_p | ||
4516 | +PQconnectdb.argtypes = [ c_char_p ] | ||
4517 | PQfinish = libpq.PQfinish | ||
4518 | +PQfinish.argtypes = [ c_void_p ] | ||
4519 | PQstatus = libpq.PQstatus | ||
4520 | +PQstatus.restype = c_int | ||
4521 | +PQstatus.argtypes = [ c_void_p ] | ||
4522 | PQexec = libpq.PQexec | ||
4523 | PQexec.restype = c_void_p | ||
4524 | +PQexec.argtypes = [ c_void_p, c_char_p ] | ||
4525 | PQresultStatus = libpq.PQresultStatus | ||
4526 | +PQresultStatus.restype = c_int | ||
4527 | +PQresultStatus.argtypes = [ c_void_p ] | ||
4528 | PQputCopyData = libpq.PQputCopyData | ||
4529 | +PQputCopyData.restype = c_int | ||
4530 | PQputCopyData.argtypes = [ c_void_p, c_void_p, c_int ] | ||
4531 | PQputCopyEnd = libpq.PQputCopyEnd | ||
4532 | +PQputCopyEnd.restype = c_int | ||
4533 | PQputCopyEnd.argtypes = [ c_void_p, c_void_p ] | ||
4534 | |||
4535 | sys.path.append(os.environ['PERF_EXEC_PATH'] + \ | ||
4536 | diff --git a/tools/testing/selftests/efivarfs/config b/tools/testing/selftests/efivarfs/config | ||
4537 | new file mode 100644 | ||
4538 | index 000000000000..4e151f1005b2 | ||
4539 | --- /dev/null | ||
4540 | +++ b/tools/testing/selftests/efivarfs/config | ||
4541 | @@ -0,0 +1 @@ | ||
4542 | +CONFIG_EFIVAR_FS=y | ||
4543 | diff --git a/tools/testing/selftests/memory-hotplug/config b/tools/testing/selftests/memory-hotplug/config | ||
4544 | index 2fde30191a47..a7e8cd5bb265 100644 | ||
4545 | --- a/tools/testing/selftests/memory-hotplug/config | ||
4546 | +++ b/tools/testing/selftests/memory-hotplug/config | ||
4547 | @@ -2,3 +2,4 @@ CONFIG_MEMORY_HOTPLUG=y | ||
4548 | CONFIG_MEMORY_HOTPLUG_SPARSE=y | ||
4549 | CONFIG_NOTIFIER_ERROR_INJECTION=y | ||
4550 | CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m | ||
4551 | +CONFIG_MEMORY_HOTREMOVE=y |