1. 07 Oct, 2015 26 commits
  2. 06 Oct, 2015 4 commits
  3. 05 Oct, 2015 10 commits
    • Andrzej Hajda's avatar
      mac80211: make ieee80211_new_mesh_header return unsigned · 5edfcee5
      Andrzej Hajda authored
      The function returns always non-negative values.
      
      The problem has been detected using proposed semantic patch
      scripts/coccinelle/tests/assign_signed_to_unsigned.cocci [1].
      
      [1]: http://permalink.gmane.org/gmane.linux.kernel/2046107Signed-off-by: default avatarAndrzej Hajda <a.hajda@samsung.com>
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      5edfcee5
    • Daniel Borkmann's avatar
      ebpf: include perf_event only where really needed · 0cdf5640
      Daniel Borkmann authored
      Commit ea317b26 ("bpf: Add new bpf map type to store the pointer
      to struct perf_event") added perf_event.h to the main eBPF header, so
      it gets included for all users. perf_event.h is actually only needed
      from array map side, so lets sanitize this a bit.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: Kaixu Xia <xiakaixu@huawei.com>
      Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0cdf5640
    • Nicolas Schichan's avatar
      ARM: net: support BPF_ALU | BPF_MOD instructions in the BPF JIT. · 4560cdff
      Nicolas Schichan authored
      For ARMv7 with UDIV instruction support, generate an UDIV instruction
      followed by an MLS instruction.
      
      For other ARM variants, generate code calling a C wrapper similar to
      the jit_udiv() function used for BPF_ALU | BPF_DIV instructions.
      
      Some performance numbers reported by the test_bpf module (the duration
      per filter run is reported in nanoseconds, between "jitted:<x>" and
      "PASS":
      
      ARMv7 QEMU nojit:	test_bpf: #3 DIV_MOD_KX jited:0 2196 PASS
      ARMv7 QEMU jit:		test_bpf: #3 DIV_MOD_KX jited:1 104 PASS
      ARMv5 QEMU nojit:	test_bpf: #3 DIV_MOD_KX jited:0 2176 PASS
      ARMv5 QEMU jit:		test_bpf: #3 DIV_MOD_KX jited:1 1104 PASS
      ARMv5 kirkwood nojit:	test_bpf: #3 DIV_MOD_KX jited:0 1103 PASS
      ARMv5 kirkwood jit:	test_bpf: #3 DIV_MOD_KX jited:1 311 PASS
      Signed-off-by: default avatarNicolas Schichan <nschichan@freebox.fr>
      Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4560cdff
    • David S. Miller's avatar
      Merge branch 'asix-rx-mem-handling' · df7b6015
      David S. Miller authored
      Mark Craske says:
      
      ====================
      Improve ASIX RX memory allocation error handling
      
      The ASIX RX handler algorithm is weak on error handling.
      There is a design flaw in the ASIX RX handler algorithm because the
      implementation for handling RX Ethernet frames for the DUB-E100 C1 can
      have Ethernet frames spanning multiple URBs. This means that payload data
      from more than 1 URB is sometimes needed to fill the socket buffer with a
      complete Ethernet frame. When the URB with the start of an Ethernet frame
      is received then an attempt is made to allocate a socket buffer. If the
      memory allocation fails then the algorithm sets the buffer pointer member
      to NULL and the function exits (no crash yet). Subsequently, the RX hander
      is called again to process the next URB which assumes there is a socket
      buffer available and the kernel crashes when there is no buffer.
      
      This patchset implements an improvement to the RX handling algorithm to
      avoid a crash when no memory is available for the socket buffer.
      
      The patchset will apply cleanly to the net-next master branch but the
      created kernel has not been tested. The driver was tested on ARM kernels
      v3.8 and v3.14 for a commercial product.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      df7b6015
    • Dean Jenkins's avatar
      asix: Continue processing URB if no RX netdev buffer · 6a570814
      Dean Jenkins authored
      Avoid a loss of synchronisation of the Ethernet Data header 32-bit
      word due to a failure to get a netdev socket buffer.
      
      The ASIX RX handling algorithm returned 0 upon a failure to get
      an allocation of a netdev socket buffer. This causes the URB
      processing to stop which potentially causes a loss of synchronisation
      with the Ethernet Data header 32-bit word. Therefore, subsequent
      processing of URBs may be rejected due to a loss of synchronisation.
      This may cause additional good Ethernet frames to be discarded
      along with outputting of synchronisation error messages.
      
      Implement a solution which checks whether a netdev socket buffer
      has been allocated before trying to copy the Ethernet frame into
      the netdev socket buffer. But continue to process the URB so that
      synchronisation is maintained. Therefore, only a single Ethernet
      frame is discarded when no netdev socket buffer is available.
      Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: default avatarMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6a570814
    • Dean Jenkins's avatar
      asix: On RX avoid creating bad Ethernet frames · 3f30b158
      Dean Jenkins authored
      When RX Ethernet frames span multiple URB socket buffers,
      the data stream may suffer a discontinuity which will cause
      the current Ethernet frame in the netdev socket buffer
      to be incomplete. This frame needs to be discarded instead
      of appending unrelated data from the current URB socket buffer
      to the Ethernet frame in the netdev socket buffer. This avoids
      creating a corrupted Ethernet frame in the netdev socket buffer.
      
      A discontinuity can occur when the previous URB socket buffer
      held an incomplete Ethernet frame due to truncation or a
      URB socket buffer containing the end of the Ethernet frame
      was missing.
      
      Therefore, add a sanity test for when an Ethernet frame
      spans multiple URB socket buffers to check that the remaining
      bytes of the currently received Ethernet frame point to
      a good Data header 32-bit word of the next Ethernet
      frame. Upon error, reset the remaining bytes variable to
      zero and discard the current netdev socket buffer.
      Assume that the Data header is located at the start of
      the current socket buffer and attempt to process the next
      Ethernet frame from there. This avoids unnecessarily
      discarding a good URB socket buffer that contains a new
      Ethernet frame.
      Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: default avatarMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3f30b158
    • Dean Jenkins's avatar
      asix: Simplify asix_rx_fixup_internal() netdev alloc · 9a5ccd8e
      Dean Jenkins authored
      The code is checking that the Ethernet frame will fit into a
      netdev allocated socket buffer within the constraints of MTU size,
      Ethernet header length plus VLAN header length.
      
      The original code was checking rx->remaining each loop of the while
      loop that processes multiple Ethernet frames per URB and/or Ethernet
      frames that span across URBs. rx->remaining decreases per while loop
      so there is no point in potentially checking multiple times that the
      Ethernet frame (remaining part) will fit into the netdev socket buffer.
      
      The modification checks that the size of the Ethernet frame will fit
      the netdev socket buffer before allocating the netdev socket buffer.
      This avoids grabbing memory and then deciding that the Ethernet frame
      is too big and then freeing the memory.
      Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: default avatarMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9a5ccd8e
    • Dean Jenkins's avatar
      asix: Tidy-up 32-bit header word synchronisation · 3bfc69ab
      Dean Jenkins authored
      Tidy-up the Data header 32-bit word synchronisation logic in
      asix_rx_fixup_internal() by removing redundant logic tests.
      
      The code is looking at the following cases of the Data header
      32-bit word that is present before each Ethernet frame:
      
      a) all 32 bits of the Data header word are in the URB socket buffer
      b) first 16 bits of the Data header word are at the end of the URB
         socket buffer
      c) last 16 bits of the Data header word are at the start of the URB
         socket buffer eg. split_head = true
      
      Note that the lifetime of rx->split_head exists outside of the
      function call and is accessed per processing of each URB. Therefore,
      split_head being true acts on the next URB to be processed.
      
      To check for b) the offset will be 16 bits (2 bytes) from the end of
      the buffer then indicate split_head is true.
      To check for c) split_head must be true because the first 16 bits
      have been found.
      To check for a) else c)
      
      Note that the || logic of the old code included the state
      (skb->len - offset == sizeof(u16) && rx->split_head) which is not
      possible because the split_head cannot be true whilst checking for b).
      This is because the split_head indicates that the first 16 bits have
      been found and that is not possible whilst checking for the first 16
      bits. Therefore simplify the logic.
      Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: default avatarMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3bfc69ab
    • Dean Jenkins's avatar
      asix: Rename remaining and size for clarity · 7b0378f5
      Dean Jenkins authored
      The Data header synchronisation is easier to understand
      if the variables "remaining" and "size" are renamed.
      
      Therefore, the lifetime of the "remaining" variable exists
      outside of asix_rx_fixup_internal() and is used to indicate
      any remaining pending bytes of the Ethernet frame that need
      to be obtained from the next socket buffer. This allows an
      Ethernet frame to span across multiple socket buffers.
      
      "size" is now local to asix_rx_fixup_internal() and contains
      the size read from the Data header 32-bit word.
      
      Add "copy_length" to hold the number of the Ethernet frame
      bytes (maybe a part of a full frame) that are to be copied
      out of the socket buffer.
      Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: default avatarMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7b0378f5
    • Daniel Borkmann's avatar
      bpf, seccomp: prepare for upcoming criu support · bab18991
      Daniel Borkmann authored
      The current ongoing effort to dump existing cBPF seccomp filters back
      to user space requires to hold the pre-transformed instructions like
      we do in case of socket filters from sk_attach_filter() side, so they
      can be reloaded in original form at a later point in time by utilities
      such as criu.
      
      To prepare for this, simply extend the bpf_prog_create_from_user()
      API to hold a flag that tells whether we should store the original
      or not. Also, fanout filters could make use of that in future for
      things like diag. While fanout filters already use bpf_prog_destroy(),
      move seccomp over to them as well to handle original programs when
      present.
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: Tycho Andersen <tycho.andersen@canonical.com>
      Cc: Pavel Emelyanov <xemul@parallels.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Alexei Starovoitov <ast@plumgrid.com>
      Tested-by: default avatarTycho Andersen <tycho.andersen@canonical.com>
      Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bab18991