Re: [PATCH iproute2 V2 1/4] rdma: Add basic infrastructure for RDMA tool

[Leon Romanovsky]

On Mon, Jul 03, 2017 at 05:33:56PM +0300, Yuval Shaia wrote:
> On Mon, Jul 03, 2017 at 05:06:55PM +0300, Leon Romanovsky wrote:
> > From: Leon Romanovsky 
> >
> > RDMA devices are cross-functional devices from one side,
> > but very tailored for the specific markets from another.
> >
> > Such diversity caused to spread of RDMA related configuration
> > across various tools, e.g. devlink, ip, ethtool, ib specific and
> > vendor specific solutions.
> >
> > This patch adds ability to fill device and port information
> > by reading RDMA netlink.
> >
> > Signed-off-by: Leon Romanovsky 
> > ---
> >  Makefile|   2 +-
> >  rdma/.gitignore |   1 +
> >  rdma/Makefile   |  22 ++
> >  rdma/rdma.c | 116 
> >  rdma/rdma.h |  71 +
> >  rdma/utils.c| 232 
> > 
> >  6 files changed, 443 insertions(+), 1 deletion(-)
> >  create mode 100644 rdma/.gitignore
> >  create mode 100644 rdma/Makefile
> >  create mode 100644 rdma/rdma.c
> >  create mode 100644 rdma/rdma.h
> >  create mode 100644 rdma/utils.c
> >
> > diff --git a/Makefile b/Makefile
> > index 18de7dcb..c255063b 100644
> > --- a/Makefile
> > +++ b/Makefile
> > @@ -52,7 +52,7 @@ WFLAGS += -Wmissing-declarations -Wold-style-definition 
> > -Wformat=2
> >  CFLAGS := $(WFLAGS) $(CCOPTS) -I../include $(DEFINES) $(CFLAGS)
> >  YACCFLAGS = -d -t -v
> >
> > -SUBDIRS=lib ip tc bridge misc netem genl tipc devlink man
> > +SUBDIRS=lib ip tc bridge misc netem genl tipc devlink rdma man
> >
> >  LIBNETLINK=../lib/libnetlink.a ../lib/libutil.a
> >  LDLIBS += $(LIBNETLINK)
> > diff --git a/rdma/.gitignore b/rdma/.gitignore
> > new file mode 100644
> > index ..51fb172b
> > --- /dev/null
> > +++ b/rdma/.gitignore
> > @@ -0,0 +1 @@
> > +rdma
> > diff --git a/rdma/Makefile b/rdma/Makefile
> > new file mode 100644
> > index ..64da2142
> > --- /dev/null
> > +++ b/rdma/Makefile
> > @@ -0,0 +1,22 @@
> > +include ../Config
> > +
> > +ifeq ($(HAVE_MNL),y)
> > +
> > +RDMA_OBJ = rdma.o utils.o
> > +
> > +TARGETS=rdma
> > +CFLAGS += $(shell $(PKG_CONFIG) libmnl --cflags)
> > +LDLIBS += $(shell $(PKG_CONFIG) libmnl --libs)
> > +
> > +endif
> > +
> > +all:   $(TARGETS) $(LIBS)
> > +
> > +rdma:  $(RDMA_OBJ) $(LIBS)
> > +   $(QUIET_LINK)$(CC) $^ $(LDFLAGS) $(LDLIBS) -o $@
> > +
> > +install: all
> > +   install -m 0755 $(TARGETS) $(DESTDIR)$(SBINDIR)
> > +
> > +clean:
> > +   rm -f $(RDMA_OBJ) $(TARGETS)
> > diff --git a/rdma/rdma.c b/rdma/rdma.c
> > new file mode 100644
> > index ..29273839
> > --- /dev/null
> > +++ b/rdma/rdma.c
> > @@ -0,0 +1,116 @@
> > +/*
> > + * rdma.c  RDMA tool
> > + *
> > + *  This program is free software; you can redistribute it 
> > and/or
> > + *  modify it under the terms of the GNU General Public License
> > + *  as published by the Free Software Foundation; either 
> > version
> > + *  2 of the License, or (at your option) any later version.
> > + *
> > + * Authors: Leon Romanovsky 
> > + */
> > +
> > +#include 
> > +#include 
> > +
> > +#include "rdma.h"
> > +#include "SNAPSHOT.h"
> > +
> > +static void help(char *name)
> > +{
> > +   pr_out("Usage: %s [ OPTIONS ] OBJECT { COMMAND | help }\n"
> > +  "where  OBJECT := { help }\n"
> > +  "   OPTIONS := { -V[ersion] | -d[etails]}\n", name);
> > +}
> > +
> > +static int cmd_help(struct rdma *rd)
> > +{
> > +   help(rd->filename);
> > +   return 0;
>
> Can we change it to void?

I did it on purpose to reuse the common command executor code
(rdma_exec_cmd) and don't introduce explicit if-else constructions
just for the "help" command.

<...>

> > +/*
> > + * This macro will be moved to generic layer,
> > + * after code will be accepted.
> > + * it is placed here to avoid rebases with upstream code.
> > + */
> > +#define MAX(a, b)  ((a) > (b) ? (a) : (b))
>
> Can we use /usr/include/sys/param.h?

Thanks for pointing it to me. This is leftover from previous versions when I
filled all structures during init phase. It is not used anymore and I'll
remove it.

>
> > +
> > +static int rd_argc(struct rdma *rd)
> > +{
> > +   return rd->argc;
> > +}
> > +
> > +static char *rd_argv(struct rdma *rd)
> > +{
> > +   if (!rd_argc(rd))
> > +   return NULL;
> > +   return *rd->argv;
> > +}
> > +
> > +static int strcmpx(const char *str1, const char *str2)
> > +{
> > +   if (strlen(str1) > strlen(str2))
> > +   return -1;
> > +   return strncmp(str1, str2, strlen(str1));
> > +}
> > +
> > +bool rd_argv_match(struct rdma *rd, const char *pattern)
> > +{
> > +   if (!rd_argc(rd))
> > +   return false;
> > +   return strcmpx(rd_argv(rd), pattern) == 0;
>
> rd_argv might return NULL.

This function is called only once in this file (in new version, I'll
mark it as "static") and it is called only after we checked that "rd"
has arguments (see function rdma_exec_cmd).
>
> > +}
> > +
> > +void 

Re: 'skb' buffer address information leakage

[Greg KH]

On Tue, Jul 04, 2017 at 01:12:18PM +0800, Dison River wrote:
> Hi all:
> I'd found several address leaks of "skb" buffer.When i have a
> arbitrary address write vulnerability in kernel(enabled kASLR),I can
> use skb's address find sk_destruct's address and overwrite it. And
> then,invoke close(sock_fd) function can trigger the
> shellcode(sk_destruct func).
> 
> In kernel 4.12-rc7
> drivers/net/irda/vlsi_ir.c:326   seq_printf(seq, "skb=%p
> data=%p hw=%p\n", rd->skb, rd->buf, rd->hw);

Irda doesn't even work, and will crash, so it's a bit hard to see this
as a "leakage" :)

I'm going to be ripping irda out soon anyway, so this isn't a real
issue.

> drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c:167
>  seq_printf(file, " frag=%p", skb);
> drivers/net/wireless/ath/wil6210/debugfs.c:926   seq_printf(s,
> "  SKB = 0x%p\n", skb);


debugfs is by nature, root-only access, so the potential for issues here
is lower than "any user can get this info".  That being said, patches
for these are always appreciated.

I also need to respin my "turn %p pointers off" patchset to prevent
future stuff like this from happening.  I want to get to that after
4.13-rc1 is out.

thanks,

greg k-h

[PATCH iproute2 V3 2/4] rdma: Add dev object

[Leon Romanovsky]

From: Leon Romanovsky 

Device (dev) object represents struct ib_device to the user space.

Device properties:
 * Device capabilities
 * FW version to the device output
 * node_guid and sys_image_guid
 * node_type

Signed-off-by: Leon Romanovsky 
---
 rdma/Makefile |   2 +-
 rdma/dev.c| 235 ++
 rdma/rdma.c   |   3 +-
 rdma/rdma.h   |  12 ++-
 rdma/utils.c  |  46 +++-
 5 files changed, 293 insertions(+), 5 deletions(-)
 create mode 100644 rdma/dev.c

diff --git a/rdma/Makefile b/rdma/Makefile
index 64da2142..123d7ac5 100644
--- a/rdma/Makefile
+++ b/rdma/Makefile
@@ -2,7 +2,7 @@ include ../Config

 ifeq ($(HAVE_MNL),y)

-RDMA_OBJ = rdma.o utils.o
+RDMA_OBJ = rdma.o utils.o dev.o

 TARGETS=rdma
 CFLAGS += $(shell $(PKG_CONFIG) libmnl --cflags)
diff --git a/rdma/dev.c b/rdma/dev.c
new file mode 100644
index ..b80e5288
--- /dev/null
+++ b/rdma/dev.c
@@ -0,0 +1,235 @@
+/*
+ * dev.c   RDMA tool
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ *
+ * Authors: Leon Romanovsky 
+ */
+
+#include "rdma.h"
+
+static int dev_help(struct rdma *rd)
+{
+   pr_out("Usage: %s dev show [DEV]\n", rd->filename);
+   return 0;
+}
+
+static void dev_print_caps(struct nlattr **tb)
+{
+   uint64_t caps;
+   uint32_t idx;
+
+   /*
+* FIXME: move to indexes when kernel will start exporting them.
+*/
+   static const char *dev_caps[64] = {
+   "RESIZE_MAX_WR",
+   "BAD_PKEY_CNTR",
+   "BAD_QKEY_CNTR",
+   "RAW_MULTI",
+   "AUTO_PATH_MIG",
+   "CHANGE_PHY_PORT",
+   "UD_AV_PORT_ENFORCE",
+   "CURR_QP_STATE_MOD",
+   "SHUTDOWN_PORT",
+   "INIT_TYPE",
+   "PORT_ACTIVE_EVENT",
+   "SYS_IMAGE_GUID",
+   "RC_RNR_NAK_GEN",
+   "SRQ_RESIZE",
+   "N_NOTIFY_CQ",
+   "LOCAL_DMA_LKEY",
+   "RESERVED",
+   "MEM_WINDOW",
+   "UD_IP_CSUM",
+   "UD_TSO",
+   "XRC",
+   "MEM_MGT_EXTENSIONS",
+   "BLOCK_MULTICAST_LOOPBACK",
+   "MEM_WINDOW_TYPE_2A",
+   "MEM_WINDOW_TYPE_2B",
+   "RC_IP_CSUM",
+   "RAW_IP_CSUM",
+   "CROSS_CHANNEL",
+   "MANAGED_FLOW_STEERING",
+   "SIGNATURE_HANDOVER",
+   "ON_DEMAND_PAGING",
+   "SG_GAPS_REG",
+   "VIRTUAL_FUNCTION",
+   "RAW_SCATTER_FCS",
+   "RDMA_NETDEV_OPA_VNIC",
+   };
+
+   if (!tb[RDMA_NLDEV_ATTR_CAP_FLAGS])
+  return;
+
+   caps = mnl_attr_get_u64(tb[RDMA_NLDEV_ATTR_CAP_FLAGS]);
+
+   pr_out("\ncaps: <");
+   for (idx = 0; idx < 64; idx++) {
+   if (caps & 0x1) {
+   pr_out("%s", dev_caps[idx]?dev_caps[idx]:"UNKNONW");
+   if (caps >> 0x1)
+   pr_out(", ");
+   }
+   caps >>= 0x1;
+   }
+
+   pr_out(">");
+}
+
+static void dev_print_fw(struct nlattr **tb)
+{
+   if (!tb[RDMA_NLDEV_ATTR_FW_VERSION])
+   return;
+
+   pr_out("fw %s ",
+  mnl_attr_get_str(tb[RDMA_NLDEV_ATTR_FW_VERSION]));
+}
+
+static void _dev_print_be64(char *name, uint64_t val)
+{
+   uint16_t vp[4];
+
+   memcpy(vp, &val, sizeof(uint64_t));
+   pr_out("%s %04x:%04x:%04x:%04x ", name, vp[3], vp[2], vp[1], vp[0]);
+}
+
+static void dev_print_node_guid(struct nlattr **tb)
+{
+   uint64_t node_guid;
+
+   if (!tb[RDMA_NLDEV_ATTR_NODE_GUID])
+   return;
+
+   node_guid = mnl_attr_get_u64(tb[RDMA_NLDEV_ATTR_NODE_GUID]);
+   _dev_print_be64("node_guid", node_guid);
+}
+
+static void dev_print_sys_image_guid(struct nlattr **tb)
+{
+   uint64_tsys_image_guid;
+
+   if (!tb[RDMA_NLDEV_ATTR_SYS_IMAGE_GUID])
+   return;
+
+   sys_image_guid = mnl_attr_get_u64(tb[RDMA_NLDEV_ATTR_SYS_IMAGE_GUID]);
+   _dev_print_be64("sys_image_guid", sys_image_guid);
+}
+
+static void dev_print_node_type(struct nlattr **tb)
+{
+   uint8_t node_type;
+   /*
+* FIXME: move to index exported by the kernel
+*/
+   static const char *str[] = {
+   "UNKNOWN",
+   "SWITCH",
+   "ROUTER",
+   "RNIC",
+   "USNIC",
+   "USNIC_UDP",
+   };
+
+   if (!tb[RDMA_NLDEV_ATTR_DEV_NODE_TYPE])
+   return;
+
+   node_type = mnl_attr_get_u8(tb[RDMA_NLDEV_ATTR_DEV_NODE_TYPE]);
+
+   if (node_type < 7 )
+   pr_out

[PATCH iproute2 V3 0/4] RDMAtool

[Leon Romanovsky]

Hi,

This is third version of series implementing the RDAMtool -  the tool
to configure RDMA devices. The initial proposal was sent as RFC [1] and
was based on sysfs entries as POC.

The current series was rewritten completely to work with RDMA netlinks as
a source of user<->kernel communications. In order to achieve that, the
RDMA netlinks were extensively refactored and modernized [2, 3, 4 and 5].

The following is an example of various runs on my machine with 5 devices
(4 in IB mode and one in Ethernet mode)

### Without parameters
$ rdma
Usage: rdma [ OPTIONS ] OBJECT { COMMAND | help }
where  OBJECT := { dev | link | help }
   OPTIONS := { -V[ersion] | -d[etails]}

### With unspecified device name
$ rdma dev
1: mlx5_0: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:3457 
sys_image_guid 5254:00c0:fe12:3457
2: mlx5_1: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:3458 
sys_image_guid 5254:00c0:fe12:3458
3: mlx5_2: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:3459 
sys_image_guid 5254:00c0:fe12:3459
4: mlx5_3: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:345a 
sys_image_guid 5254:00c0:fe12:345a
5: mlx5_4: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:345b 
sys_image_guid 5254:00c0:fe12:345b

### Detailed mode
$ rdma -d dev
1: mlx5_0: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:3457 
sys_image_guid 5254:00c0:fe12:3457
caps: 
2: mlx5_1: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:3458 
sys_image_guid 5254:00c0:fe12:3458
caps: 
3: mlx5_2: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:3459 
sys_image_guid 5254:00c0:fe12:3459
caps: 
4: mlx5_3: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:345a 
sys_image_guid 5254:00c0:fe12:345a
caps: 
5: mlx5_4: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:345b 
sys_image_guid 5254:00c0:fe12:345b
caps: 

### Specific device
$ rdma dev show mlx5_4
5: mlx5_4: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:345b 
sys_image_guid 5254:00c0:fe12:345b

### Specific device in detailed mode
$ rdma dev show mlx5_4 -d
5: mlx5_4: node_type SWITCH fw 2.8. node_guid 5254:00c0:fe12:345b 
sys_image_guid 5254:00c0:fe12:345b
caps: 

### Unknown command (caps)
$ rdma dev show mlx5_4 caps
Unknown parameter 'caps'.

### Link properties without device name
$ rdma link
1/1: mlx5_0/1: subnet_prefix fe80::: lid 13399 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
2/1: mlx5_1/1: subnet_prefix fe80::: lid 13400 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
3/1: mlx5_2/1: subnet_prefix fe80::: lid 13401 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
4/1: mlx5_3/1: state DOWN physical_state DISABLED
5/1: mlx5_4/1: subnet_prefix fe80::: lid 13403 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP

### Link properties in detailed mode
$ rdma link -d
1/1: mlx5_0/1: subnet_prefix fe80::: lid 13399 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
caps: 
2/1: mlx5_1/1: subnet_prefix fe80::: lid 13400 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
caps: 
3/1: mlx5_2/1: subnet_prefix fe80::: lid 13401 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
caps: 
4/1: mlx5_3/1: state DOWN physical_state DISABLED
caps: 
5/1: mlx5_4/1: subnet_prefix fe80::: lid 13403 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
caps: 

### All links for specific device
$ rdma link show mlx5_3
1/1: mlx5_0/1: subnet_prefix fe80::: lid 13399 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP

### Detailed link properties for specific device
$ rdma link -d show mlx5_3
1/1: mlx5_0/1: subnet_prefix fe80::: lid 13399 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP
caps: 

### Specific port for specific device
$ rdma link show mlx5_4/1
1/1: mlx5_0/1: subnet_prefix fe80::: lid 13399 sm_lid 49151 lmc 0 
state ACTIVE physical_state LINK_UP

### Unknown parameter
$ rdma link show mlx5_4/1 caps
Unknown parameter 'caps'.

Thanks

Changelog:
v2->v3:
 * Removed MAX()
 * Reduced scope of rd_argv_match
 * Removed return from rdma_free_devmap
 * Added extra break at rdma_send_msg
v1->v2:
 * Squashed multiple (and similar) patches to be one patch for dev object
   and one patch for link object.
 * Removed port_map struct
 * Removed global netlink dump during initialization, it removed the need to 
store
   the intermediate variables and reuse ability of netlink to signal if variable
   exists or doesn't.
 * Added "-d" --details option and put all CAPs under it.

v0->v1:
 * Moved hunk with changes in man/Makefile from first patch to the last patch
 * Removed the "unknown command" from the examples in commit messages
 * Removed special "caps" parsing command and put it to be part of general 
"show" command
 * Changed parsed capability format to be similar to iproute2 suite
 * Added FW version as an output

[PATCH iproute2 V3 1/4] rdma: Add basic infrastructure for RDMA tool

[Leon Romanovsky]

From: Leon Romanovsky 

RDMA devices are cross-functional devices from one side,
but very tailored for the specific markets from another.

Such diversity caused to spread of RDMA related configuration
across various tools, e.g. devlink, ip, ethtool, ib specific and
vendor specific solutions.

This patch adds ability to fill device and port information
by reading RDMA netlink.

Signed-off-by: Leon Romanovsky 
---
 Makefile|   2 +-
 rdma/.gitignore |   1 +
 rdma/Makefile   |  22 ++
 rdma/rdma.c | 116 +
 rdma/rdma.h |  70 ++
 rdma/utils.c| 223 
 6 files changed, 433 insertions(+), 1 deletion(-)
 create mode 100644 rdma/.gitignore
 create mode 100644 rdma/Makefile
 create mode 100644 rdma/rdma.c
 create mode 100644 rdma/rdma.h
 create mode 100644 rdma/utils.c

diff --git a/Makefile b/Makefile
index 18de7dcb..c255063b 100644
--- a/Makefile
+++ b/Makefile
@@ -52,7 +52,7 @@ WFLAGS += -Wmissing-declarations -Wold-style-definition 
-Wformat=2
 CFLAGS := $(WFLAGS) $(CCOPTS) -I../include $(DEFINES) $(CFLAGS)
 YACCFLAGS = -d -t -v

-SUBDIRS=lib ip tc bridge misc netem genl tipc devlink man
+SUBDIRS=lib ip tc bridge misc netem genl tipc devlink rdma man

 LIBNETLINK=../lib/libnetlink.a ../lib/libutil.a
 LDLIBS += $(LIBNETLINK)
diff --git a/rdma/.gitignore b/rdma/.gitignore
new file mode 100644
index ..51fb172b
--- /dev/null
+++ b/rdma/.gitignore
@@ -0,0 +1 @@
+rdma
diff --git a/rdma/Makefile b/rdma/Makefile
new file mode 100644
index ..64da2142
--- /dev/null
+++ b/rdma/Makefile
@@ -0,0 +1,22 @@
+include ../Config
+
+ifeq ($(HAVE_MNL),y)
+
+RDMA_OBJ = rdma.o utils.o
+
+TARGETS=rdma
+CFLAGS += $(shell $(PKG_CONFIG) libmnl --cflags)
+LDLIBS += $(shell $(PKG_CONFIG) libmnl --libs)
+
+endif
+
+all:   $(TARGETS) $(LIBS)
+
+rdma:  $(RDMA_OBJ) $(LIBS)
+   $(QUIET_LINK)$(CC) $^ $(LDFLAGS) $(LDLIBS) -o $@
+
+install: all
+   install -m 0755 $(TARGETS) $(DESTDIR)$(SBINDIR)
+
+clean:
+   rm -f $(RDMA_OBJ) $(TARGETS)
diff --git a/rdma/rdma.c b/rdma/rdma.c
new file mode 100644
index ..29273839
--- /dev/null
+++ b/rdma/rdma.c
@@ -0,0 +1,116 @@
+/*
+ * rdma.c  RDMA tool
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ *
+ * Authors: Leon Romanovsky 
+ */
+
+#include 
+#include 
+
+#include "rdma.h"
+#include "SNAPSHOT.h"
+
+static void help(char *name)
+{
+   pr_out("Usage: %s [ OPTIONS ] OBJECT { COMMAND | help }\n"
+  "where  OBJECT := { help }\n"
+  "   OPTIONS := { -V[ersion] | -d[etails]}\n", name);
+}
+
+static int cmd_help(struct rdma *rd)
+{
+   help(rd->filename);
+   return 0;
+}
+
+static int rd_cmd(struct rdma *rd)
+{
+   const struct rdma_cmd cmds[] = {
+   { NULL, cmd_help },
+   { "help",   cmd_help },
+   { 0 }
+   };
+
+   return rdma_exec_cmd(rd, cmds, "object");
+}
+
+static int rd_init(struct rdma *rd, int argc, char **argv, char *filename)
+{
+   uint32_t seq;
+   int ret;
+
+   rd->filename = filename;
+   rd->argc = argc;
+   rd->argv = argv;
+   INIT_LIST_HEAD(&rd->dev_map_list);
+   rd->buff = malloc(MNL_SOCKET_BUFFER_SIZE);
+   if (!rd->buff)
+   return -ENOMEM;
+
+   rdma_prepare_msg(rd, RDMA_NLDEV_CMD_GET, &seq, (NLM_F_REQUEST | 
NLM_F_ACK | NLM_F_DUMP));
+   if ((ret = rdma_send_msg(rd)))
+   return ret;
+
+   return rdma_recv_msg(rd, rd_dev_init_cb, rd, seq);
+}
+
+static void rd_free(struct rdma *rd)
+{
+   free(rd->buff);
+   rdma_free_devmap(rd);
+}
+int main(int argc, char **argv)
+{
+   static const struct option long_options[] = {
+   { "version",no_argument,NULL, 'V' },
+   { "help",   no_argument,NULL, 'h' },
+   { "details",no_argument,NULL, 'd' },
+   { NULL, 0, NULL, 0 }
+   };
+   bool show_details = false;
+   char *filename;
+   struct rdma rd;
+   int opt;
+   int err;
+
+   filename = basename(argv[0]);
+
+   while ((opt = getopt_long(argc, argv, "Vhd",
+ long_options, NULL)) >= 0) {
+
+   switch (opt) {
+   case 'V':
+   printf("%s utility, iproute2-ss%s\n", filename, 
SNAPSHOT);
+   return EXIT_SUCCESS;
+   case 'd':
+   show_details = true;
+   break;
+   case 'h':
+   help(filename);
+   return EXIT_SUCCESS;
+   default:
+ 

[PATCH iproute2 V3 4/4] rdma: Add initial manual for the tool

[Leon Romanovsky]

From: Leon Romanovsky 

Signed-off-by: Leon Romanovsky 
---
 man/man8/Makefile |  3 +-
 man/man8/rdma.8   | 82 +++
 2 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 man/man8/rdma.8

diff --git a/man/man8/Makefile b/man/man8/Makefile
index f3318644..81979a07 100644
--- a/man/man8/Makefile
+++ b/man/man8/Makefile
@@ -19,7 +19,8 @@ MAN8PAGES = $(TARGETS) ip.8 arpd.8 lnstat.8 routel.8 rtacct.8 
rtmon.8 rtpr.8 ss.
tc-simple.8 tc-skbedit.8 tc-vlan.8 tc-xt.8 tc-skbmod.8 tc-ife.8 \
tc-tunnel_key.8 tc-sample.8 \
devlink.8 devlink-dev.8 devlink-monitor.8 devlink-port.8 devlink-sb.8 \
-   ifstat.8
+   ifstat.8 \
+   rdma.8

 all: $(TARGETS)

diff --git a/man/man8/rdma.8 b/man/man8/rdma.8
new file mode 100644
index ..7578c15e
--- /dev/null
+++ b/man/man8/rdma.8
@@ -0,0 +1,82 @@
+.TH RDMA 8 "28 Mar 2017" "iproute2" "Linux"
+.SH NAME
+rdma \- RDMA tool
+.SH SYNOPSIS
+.sp
+.ad l
+.in +8
+.ti -8
+.B rdma
+.RI "[ " OPTIONS " ] " OBJECT " { " COMMAND " | "
+.BR help " }"
+.sp
+
+.ti -8
+.IR OBJECT " := { "
+.BR dev " | " link " }"
+.sp
+
+.ti -8
+.IR OPTIONS " := { "
+\fB\-V\fR[\fIersion\fR] }
+
+.SH OPTIONS
+
+.TP
+.BR "\-V" , " -Version"
+Print the version of the
+.B rdma
+tool and exit.
+
+.SS
+.I OBJECT
+
+.TP
+.B dev
+- RDMA device.
+
+.TP
+.B link
+- RDMA port related.
+
+.PP
+The names of all objects may be written in full or
+abbreviated form, for example
+.B stats
+can be abbreviated as
+.B stat
+or just
+.B s.
+
+.SS
+.I COMMAND
+
+Specifies the action to perform on the object.
+The set of possible actions depends on the object type.
+As a rule, it is possible to
+.B show
+(or
+.B list
+) objects, but some objects do not allow all of these operations
+or have some additional commands. The
+.B help
+command is available for all objects. It prints
+out a list of available commands and argument syntax conventions.
+.sp
+If no command is given, some default command is assumed.
+Usually it is
+.B list
+or, if the objects of this class cannot be listed,
+.BR "help" .
+
+.SH EXIT STATUS
+Exit status is 0 if command was successful or a positive integer upon failure.
+
+.SH REPORTING BUGS
+Report any bugs to the Linux RDMA mailing list
+.B 
+where the development and maintenance is primarily done.
+You do not have to be subscribed to the list to send a message there.
+
+.SH AUTHOR
+Leon Romanovsky 
--
2.13.2

[PATCH iproute2 V3 3/4] rdma: Add link object

[Leon Romanovsky]

From: Leon Romanovsky 

Link (port) object represent struct ib_port to the user space.

Link properties:
 * Port capabilities
 * IB subnet prefix
 * LID, SM_LID and LMC
 * Port state
 * Physical state

Signed-off-by: Leon Romanovsky 
---
 rdma/Makefile |   2 +-
 rdma/link.c   | 280 ++
 rdma/rdma.c   |   3 +-
 rdma/utils.c  |   5 ++
 4 files changed, 288 insertions(+), 2 deletions(-)
 create mode 100644 rdma/link.c

diff --git a/rdma/Makefile b/rdma/Makefile
index 123d7ac5..1a9e4b1a 100644
--- a/rdma/Makefile
+++ b/rdma/Makefile
@@ -2,7 +2,7 @@ include ../Config

 ifeq ($(HAVE_MNL),y)

-RDMA_OBJ = rdma.o utils.o dev.o
+RDMA_OBJ = rdma.o utils.o dev.o link.o

 TARGETS=rdma
 CFLAGS += $(shell $(PKG_CONFIG) libmnl --cflags)
diff --git a/rdma/link.c b/rdma/link.c
new file mode 100644
index ..f92b4cef
--- /dev/null
+++ b/rdma/link.c
@@ -0,0 +1,280 @@
+/*
+ * link.c  RDMA tool
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ *
+ * Authors: Leon Romanovsky 
+ */
+
+#include "rdma.h"
+
+static int link_help(struct rdma *rd)
+{
+   pr_out("Usage: %s link show [DEV/PORT_INDEX]\n", rd->filename);
+   return 0;
+}
+
+static void link_print_caps(struct nlattr **tb)
+{
+   uint64_t caps;
+   uint32_t idx;
+
+   /*
+* FIXME: move to indexes when kernel will start exporting them.
+*/
+   static const char *link_caps[64] = {
+   "UNKNOWN",
+   "SM",
+   "NOTICE",
+   "TRAP",
+   "OPT_IPD",
+   "AUTO_MIGR",
+   "SL_MAP",
+   "MKEY_NVRAM",
+   "PKEY_NVRAM",
+   "LED_INFO",
+   "SM_DISABLED",
+   "SYS_IMAGE_GUID",
+   "PKEY_SW_EXT_PORT_TRAP",
+   "UNKNOWN",
+   "EXTENDED_SPEEDS",
+   "UNKNOWN",
+   "CM",
+   "SNMP_TUNNEL",
+   "REINIT",
+   "DEVICE_MGMT",
+   "VENDOR_CLASS",
+   "DR_NOTICE",
+   "CAP_MASK_NOTICE",
+   "BOOT_MGMT",
+   "LINK_LATENCY",
+   "CLIENT_REG",
+   "IP_BASED_GIDS",
+   };
+
+   if (!tb[RDMA_NLDEV_ATTR_CAP_FLAGS])
+   return;
+
+   caps = mnl_attr_get_u64(tb[RDMA_NLDEV_ATTR_CAP_FLAGS]);
+
+   pr_out("\ncaps: <");
+   for (idx = 0; idx < 64; idx++) {
+   if (caps & 0x1) {
+   pr_out("%s", link_caps[idx]?link_caps[idx]:"UNKNONW");
+   if (caps >> 0x1)
+   pr_out(", ");
+   }
+   caps >>= 0x1;
+   }
+
+   pr_out(">");
+}
+
+static void link_print_subnet_prefix(struct nlattr **tb)
+{
+   uint64_t subnet_prefix;
+   uint16_t sp[4];
+
+   if (!tb[RDMA_NLDEV_ATTR_SUBNET_PREFIX])
+   return;
+
+   subnet_prefix = mnl_attr_get_u64(tb[RDMA_NLDEV_ATTR_SUBNET_PREFIX]);
+   memcpy(sp, &subnet_prefix, sizeof(uint64_t));
+   pr_out("subnet_prefix %04x:%04x:%04x:%04x ", sp[3], sp[2], sp[1], 
sp[0]);
+}
+
+static void link_print_lid(struct nlattr **tb)
+{
+   if (!tb[RDMA_NLDEV_ATTR_LID])
+   return;
+
+   pr_out("lid %u ",
+  mnl_attr_get_u32(tb[RDMA_NLDEV_ATTR_LID]));
+}
+
+static void link_print_sm_lid(struct nlattr **tb)
+{
+
+   if (!tb[RDMA_NLDEV_ATTR_SM_LID])
+   return;
+
+   pr_out("sm_lid %u ",
+  mnl_attr_get_u32(tb[RDMA_NLDEV_ATTR_SM_LID]));
+}
+
+static void link_print_lmc(struct nlattr **tb)
+{
+   if (!tb[RDMA_NLDEV_ATTR_LMC])
+   return;
+
+   pr_out("lmc %u ", mnl_attr_get_u8(tb[RDMA_NLDEV_ATTR_LMC]));
+}
+
+static void link_print_state(struct nlattr **tb)
+{
+   uint8_t state;
+   /*
+* FIXME: move to index exported by the kernel
+*/
+   static const char *str[] = {
+   "NOP",
+   "DOWN",
+   "INIT",
+   "ARMED",
+   "ACTIVE",
+   "ACTIVE_DEFER",
+   };
+
+   if (!tb[RDMA_NLDEV_ATTR_PORT_STATE])
+   return;
+
+   state = mnl_attr_get_u8(tb[RDMA_NLDEV_ATTR_PORT_STATE]);
+
+   if (state < 6 )
+   pr_out("state %s ", str[state]);
+   else
+   pr_out("state UNKNOWN ");
+}
+
+static void link_print_phys_state(struct nlattr **tb)
+{
+   uint8_t phys_state;
+   /*
+* FIXME: move to index exported by the kernel
+*/
+   static const char *str[] = {
+   "UNKNOWN",
+   "SLEEP",
+   "POLLING",
+   "DISABLED",
+   "PORT_CONFIG

Re: [PATCH] vmalloc: respect the GFP_NOIO and GFP_NOFS flags

[Michal Hocko]

On Mon 03-07-17 18:57:14, Mikulas Patocka wrote:
> 
> 
> On Mon, 3 Jul 2017, Michal Hocko wrote:
> 
> > We can add a warning (or move it from kvmalloc) and hope that the
> > respective maintainers will fix those places properly. The reason I
> > didn't add the warning to vmalloc and kept it in kvmalloc was to catch
> > only new users rather than suddenly splat on existing ones. Note that
> > there are users with panic_on_warn enabled.
> > 
> > Considering how many NOFS users we have in tree I would rather work with
> > maintainers to fix them.
> 
> So - do you want this patch?

no, see below
 
> I still believe that the previous patch that pushes 
> memalloc_noio/nofs_save into __vmalloc is better than this.

It is, but both of them are actually wrong. Why? Because that would be
just a mindless application of the scope where the scope doesn't match
the actual reclaim recursion restricted scope. Really, the right way to
go is to simply talk to the respective maintainers. Find out whether
NOFS context is really needed and if so find the scope (e.g. a lock
which would be needed in the reclaim context) and document it. This is
not a trivial work to do but a) we do not seem to have any bug reports
complaining about these call sites so there is no need to hurry and b)
this will result in a cleaner and easier to maintain code.
-- 
Michal Hocko
SUSE Labs

Re: [PATCH 0/9] v2 ipv4/ipv6 refcount conversions

[David Miller]

From: Elena Reshetova 
Date: Tue,  4 Jul 2017 09:34:53 +0300

> Changes in v2:
>  * rebase on top of net-next
>  * currently by default refcount_t = atomic_t (*) and uses all 
>atomic standard operations unless CONFIG_REFCOUNT_FULL is enabled.
>This is a compromise for the systems that are critical on
>performance (such as net) and cannot accept even slight delay
>on the refcounter operations.
> 
> This series, for ipv4/ipv6 network components, replaces atomic_t reference
> counters with the new refcount_t type and API (see include/linux/refcount.h).
> By doing this we prevent intentional or accidental
> underflows or overflows that can led to use-after-free vulnerabilities.
> 
> The patches are fully independent and can be cherry-picked separately.
> In order to try with refcount functionality enabled in run-time,
> CONFIG_REFCOUNT_FULL must be enabled.
 ...

Series applied, thanks.

Re: [PATCH] net: ethernet: mediatek: fixed deadlock captured by lockdep

[David Miller]

From: 
Date: Tue, 4 Jul 2017 11:17:36 +0800

> From: Sean Wang 
> 
> Lockdep found an inconsistent lock state when mtk_get_stats64 is called
> in user context while NAPI updates MAC statistics in softirq.
> 
> Use spin_trylock_bh/spin_unlock_bh fix following lockdep warning.
 ...
> Signed-off-by: Sean Wang 

Good catch, applied, thanks.

Re: [PATCH net v2 1/1] net: reflect mark on tcp syn ack packets

[David Miller]

From: Jamal Hadi Salim 
Date: Mon,  3 Jul 2017 09:51:50 -0400

> From: Jamal Hadi Salim 
> 
> SYN-ACK responses on a server in response to a SYN from a client
> did not get the injected skb mark that was tagged on the SYN packet.
> 
> Fixes: 84f39b08d786 ("net: support marking accepting TCP sockets")
> Reviewed-by: Lorenzo Colitti 
> Signed-off-by: Jamal Hadi Salim 

Applied, thanks Jamal.

Re: [PATCH 1/1] bridge: mdb: report complete_info ptr as not a kmemleak

[David Miller]

From: Eduardo Valentin 
Date: Mon, 3 Jul 2017 10:06:34 -0700

> We currently get the following kmemleak report:
 ...
> This patch flags the complete_info ptr object as not a leak as it will
> get freed when .complete_priv() is called,

We don't call .complete_priv().  We call .complete().

 for the br mdb case, it
> will be freed at br_mdb_complete().
> 
> Cc: stable  # v4.9+
> Reviewed-by: Vallish Vaidyeshwara 
> Signed-off-by: Eduardo Valentin 

I don't understand why kmemleak cannot see this.

We store the pointer globally when we do the switchdev_port_obv_add()
call and it should be able to see that.

Re: [PATCH net-next] mpls: route get support

[David Miller]

From: Roopa Prabhu 
Date: Mon,  3 Jul 2017 15:31:21 -0700

> From: Roopa Prabhu 
> 
> This patch adds RTM_GETROUTE doit handler for mpls routes.
 ...
> Signed-off-by: Roopa Prabhu 

Also applied, thanks.

Re: [PATCH net-next] bridge: allow ext learned entries to change ports

[David Miller]

From: Roopa Prabhu 
Date: Mon,  3 Jul 2017 15:14:59 -0700

> From: Nikolay Aleksandrov 
> 
> current code silently ignores change of port in the request
> message. This patch makes sure the port is modified and
> notification is sent to userspace.
> 
> Fixes: cf6b8e1eedff ("bridge: add API to notify bridge driver of learned FBD 
> on offloaded device")
> Signed-off-by: Nikolay Aleksandrov 
> Signed-off-by: Roopa Prabhu 

Applied.

net-next is CLOSED

[David Miller]

Please do not submit anything other than bug fixes from
this point forward, thank you.

I should be sending a net-next pull request to Linus today
or tomorrow.

Thanks.

Re: [PATCH iproute2 V3 2/4] rdma: Add dev object

[Leon Romanovsky]

On Tue, Jul 04, 2017 at 10:55:39AM +0300, Leon Romanovsky wrote:
> From: Leon Romanovsky 
>
> Device (dev) object represents struct ib_device to the user space.
>
> Device properties:
>  * Device capabilities
>  * FW version to the device output
>  * node_guid and sys_image_guid
>  * node_type
>
> Signed-off-by: Leon Romanovsky 
> ---

<...>

> +}
> +
> +static void dev_print_node_type(struct nlattr **tb)
> +{
> + uint8_t node_type;
> + /*
> +  * FIXME: move to index exported by the kernel
> +  */
> + static const char *str[] = {
> + "UNKNOWN",
> + "SWITCH",
> + "ROUTER",
> + "RNIC",
> + "USNIC",
> + "USNIC_UDP",
> + };

There is a bug here, i forgot to add "CA" to the list of node_types
(before SWITCH). Thanks to Or Gerlitz who spotted it.

Thanks


signature.asc
Description: PGP signature

[PATCH net 0/3] nfp: port enumeration change and FW ABI adjustment

[Jakub Kicinski]

Hi!

This set changes the way ports are numbered internally to avoid MAC address
changes and invalid link information when breakout is configured.  Second
patch gets rid of old way of looking up MAC addresses in device information
which caused all this confusion.

Patch 3 is a small adjustment to the new FW ABI version we introduced in
this release cycle.


To clarify these are intended for 4.13, naturally.

Jakub Kicinski (3):
  nfp: improve order of interfaces in breakout mode
  nfp: remove legacy MAC address lookup
  nfp: default to chained metadata prepend format

 drivers/net/ethernet/netronome/nfp/flower/main.c   |  3 +-
 drivers/net/ethernet/netronome/nfp/nfp_app_nic.c   |  2 +-
 drivers/net/ethernet/netronome/nfp/nfp_main.h  |  5 +--
 .../net/ethernet/netronome/nfp/nfp_net_common.c|  9 -
 drivers/net/ethernet/netronome/nfp/nfp_net_main.c  | 44 +-
 drivers/net/ethernet/netronome/nfp/nfp_port.c  | 14 +++
 6 files changed, 28 insertions(+), 49 deletions(-)

-- 
2.11.0

[PATCH net 2/3] nfp: remove legacy MAC address lookup

[Jakub Kicinski]

The legacy MAC address lookup doesn't work well with breakout
cables.  We are probably better off picking random addresses
than the wrong ones in the theoretical scenario where management
FW didn't tell us what the port config is.

Signed-off-by: Jakub Kicinski 
---
 drivers/net/ethernet/netronome/nfp/flower/main.c  |  3 +-
 drivers/net/ethernet/netronome/nfp/nfp_app_nic.c  |  2 +-
 drivers/net/ethernet/netronome/nfp/nfp_main.h |  3 +-
 drivers/net/ethernet/netronome/nfp/nfp_net_main.c | 34 ---
 4 files changed, 8 insertions(+), 34 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c 
b/drivers/net/ethernet/netronome/nfp/flower/main.c
index 5fe6d3582597..fc10f27e0a0c 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -245,8 +245,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct 
nfp_flower_priv *priv)
}
 
SET_NETDEV_DEV(reprs->reprs[phys_port], &priv->nn->pdev->dev);
-   nfp_net_get_mac_addr(app->pf, port,
-eth_tbl->ports[i].eth_index);
+   nfp_net_get_mac_addr(app->pf, port);
 
cmsg_port_id = nfp_flower_cmsg_phys_port(phys_port);
err = nfp_repr_init(app, reprs->reprs[phys_port],
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c 
b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
index c11a6c34e217..4e37c81f9eaf 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
@@ -69,7 +69,7 @@ int nfp_app_nic_vnic_init(struct nfp_app *app, struct nfp_net 
*nn,
if (err)
return err < 0 ? err : 0;
 
-   nfp_net_get_mac_addr(app->pf, nn->port, id);
+   nfp_net_get_mac_addr(app->pf, nn->port);
 
return 0;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h 
b/drivers/net/ethernet/netronome/nfp/nfp_main.h
index 365252ab4660..6922410806db 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h
@@ -149,8 +149,7 @@ void nfp_net_pci_remove(struct nfp_pf *pf);
 int nfp_hwmon_register(struct nfp_pf *pf);
 void nfp_hwmon_unregister(struct nfp_pf *pf);
 
-void
-nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port, unsigned int 
id);
+void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port);
 
 bool nfp_ctrl_tx(struct nfp_net *nn, struct sk_buff *skb);
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c 
b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
index bfcdada29cc0..5797dbf2b507 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
@@ -84,46 +84,22 @@ static int nfp_is_ready(struct nfp_pf *pf)
  * nfp_net_get_mac_addr() - Get the MAC address.
  * @pf:   NFP PF handle
  * @port: NFP port structure
- * @id:  NFP port id
  *
  * First try to get the MAC address from NSP ETH table. If that
- * fails try HWInfo.  As a last resort generate a random address.
+ * fails generate a random address.
  */
-void
-nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port, unsigned int id)
+void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port)
 {
struct nfp_eth_table_port *eth_port;
-   u8 mac_addr[ETH_ALEN];
-   const char *mac_str;
-   char name[32];
 
eth_port = __nfp_port_get_eth_port(port);
-   if (eth_port) {
-   ether_addr_copy(port->netdev->dev_addr, eth_port->mac_addr);
-   ether_addr_copy(port->netdev->perm_addr, eth_port->mac_addr);
-   return;
-   }
-
-   snprintf(name, sizeof(name), "eth%d.mac", id);
-
-   mac_str = nfp_hwinfo_lookup(pf->hwinfo, name);
-   if (!mac_str) {
-   nfp_warn(pf->cpp, "Can't lookup MAC address. Generate\n");
-   eth_hw_addr_random(port->netdev);
-   return;
-   }
-
-   if (sscanf(mac_str, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
-  &mac_addr[0], &mac_addr[1], &mac_addr[2],
-  &mac_addr[3], &mac_addr[4], &mac_addr[5]) != 6) {
-   nfp_warn(pf->cpp, "Can't parse MAC address (%s). Generate.\n",
-mac_str);
+   if (!eth_port) {
eth_hw_addr_random(port->netdev);
return;
}
 
-   ether_addr_copy(port->netdev->dev_addr, mac_addr);
-   ether_addr_copy(port->netdev->perm_addr, mac_addr);
+   ether_addr_copy(port->netdev->dev_addr, eth_port->mac_addr);
+   ether_addr_copy(port->netdev->perm_addr, eth_port->mac_addr);
 }
 
 static struct nfp_eth_table_port *
-- 
2.11.0

[PATCH net 1/3] nfp: improve order of interfaces in breakout mode

[Jakub Kicinski]

For historical reasons we enumerate the vNICs in order.  This means
that if user configures breakout on a multiport card, the first
interface of the second port will have its MAC address changed.

What's worse, when moved from static information (HWInfo) to using
management FW (NSP), more features started depending on the port ids.
Right now in case of breakout first subport of the second port and
second subport of the first port will have their link info swapped.

Revise the ordering scheme so that first subport maintains its address.
Side effect of this change is that we will use base lane ids in
devlink (i.e. 40G ports will be 4 ids apart), e.g.:

pci/:04:00.0/0: type eth netdev p6p1
pci/:04:00.0/4: type eth netdev p6p2

Note that behaviour of phys_port_id is not changed since there is
a separate id number for the subport there.

Fixes: ec8b1fbe682d ("nfp: support port splitting via devlink")
Signed-off-by: Jakub Kicinski 
---
 drivers/net/ethernet/netronome/nfp/nfp_main.h |  2 --
 drivers/net/ethernet/netronome/nfp/nfp_net_main.c | 10 +-
 drivers/net/ethernet/netronome/nfp/nfp_port.c | 14 +++---
 3 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h 
b/drivers/net/ethernet/netronome/nfp/nfp_main.h
index a08cfba7e68e..365252ab4660 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h
@@ -149,8 +149,6 @@ void nfp_net_pci_remove(struct nfp_pf *pf);
 int nfp_hwmon_register(struct nfp_pf *pf);
 void nfp_hwmon_unregister(struct nfp_pf *pf);
 
-struct nfp_eth_table_port *
-nfp_net_find_port(struct nfp_eth_table *eth_tbl, unsigned int id);
 void
 nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port, unsigned int 
id);
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c 
b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
index c85a2f18c4df..bfcdada29cc0 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
@@ -126,13 +126,13 @@ nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port 
*port, unsigned int id)
ether_addr_copy(port->netdev->perm_addr, mac_addr);
 }
 
-struct nfp_eth_table_port *
-nfp_net_find_port(struct nfp_eth_table *eth_tbl, unsigned int id)
+static struct nfp_eth_table_port *
+nfp_net_find_port(struct nfp_eth_table *eth_tbl, unsigned int index)
 {
int i;
 
for (i = 0; eth_tbl && i < eth_tbl->count; i++)
-   if (eth_tbl->ports[i].eth_index == id)
+   if (eth_tbl->ports[i].index == index)
return ð_tbl->ports[i];
 
return NULL;
@@ -202,7 +202,7 @@ static void nfp_net_pf_free_vnics(struct nfp_pf *pf)
 static struct nfp_net *
 nfp_net_pf_alloc_vnic(struct nfp_pf *pf, bool needs_netdev,
  void __iomem *ctrl_bar, void __iomem *qc_bar,
- int stride, unsigned int eth_id)
+ int stride, unsigned int id)
 {
u32 tx_base, rx_base, n_tx_rings, n_rx_rings;
struct nfp_net *nn;
@@ -228,7 +228,7 @@ nfp_net_pf_alloc_vnic(struct nfp_pf *pf, bool needs_netdev,
nn->stride_tx = stride;
 
if (needs_netdev) {
-   err = nfp_app_vnic_init(pf->app, nn, eth_id);
+   err = nfp_app_vnic_init(pf->app, nn, id);
if (err) {
nfp_net_free(nn);
return ERR_PTR(err);
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_port.c 
b/drivers/net/ethernet/netronome/nfp/nfp_port.c
index 776e54dd5dd0..e42644dbb865 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_port.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_port.c
@@ -184,24 +184,24 @@ nfp_port_get_phys_port_name(struct net_device *netdev, 
char *name, size_t len)
 int nfp_port_init_phy_port(struct nfp_pf *pf, struct nfp_app *app,
   struct nfp_port *port, unsigned int id)
 {
-   port->eth_id = id;
-   port->eth_port = nfp_net_find_port(pf->eth_tbl, id);
-
/* Check if vNIC has external port associated and cfg is OK */
-   if (!port->eth_port) {
+   if (!pf->eth_tbl || id >= pf->eth_tbl->count) {
nfp_err(app->cpp,
-   "NSP port entries don't match vNICs (no entry for port 
#%d)\n",
+   "NSP port entries don't match vNICs (no entry %d)\n",
id);
return -EINVAL;
}
-   if (port->eth_port->override_changed) {
+   if (pf->eth_tbl->ports[id].override_changed) {
nfp_warn(app->cpp,
 "Config changed for port #%d, reboot required before 
port will be operational\n",
-id);
+pf->eth_tbl->ports[id].index);
port->type = NFP_PORT_INVALID;
return 0;
}
 
+   port->eth_port = &pf->eth_tbl->ports[id];
+   port->eth_id = pf->eth_tb

[PATCH net 3/3] nfp: default to chained metadata prepend format

[Jakub Kicinski]

ABI 4.x introduced the chained metadata format and made it the
only one possible.  There are cases, however, where the old
format is preferred - mostly to make interoperation with VFs
using ABI 3.x easier for the datapath.  In ABI 5.x we allowed
for more flexibility by selecting the metadata format based
on capabilities.  The default was left to non-chained.

In case of fallback traffic, there is no capability telling the
driver there may be chained metadata.  With a very stripped-
-down FW the default old metadata format would be selected
making the driver drop all fallback traffic.

This patch changes the default selection in the driver. It
should not hurt with old firmwares, because if they don't
advertise RSS they will not produce metadata anyway.  New
firmwares advertising ABI 5.x, however, can depend on the
driver defaulting to chained format.

Fixes: f9380629fafc ("nfp: advertise support for NFD ABI 0.5")
Suggested-by: Michael Rapson 
Signed-off-by: Jakub Kicinski 
---
 drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c 
b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 30f82b41d400..18750ff0ede6 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3719,10 +3719,17 @@ int nfp_net_init(struct nfp_net *nn)
nn->cap = nn_readl(nn, NFP_NET_CFG_CAP);
nn->max_mtu = nn_readl(nn, NFP_NET_CFG_MAX_MTU);
 
-   /* Chained metadata is signalled by capabilities except in version 4 */
+   /* ABI 4.x and ctrl vNIC always use chained metadata, in other cases
+* we allow use of non-chained metadata if RSS(v1) is the only
+* advertised capability requiring metadata.
+*/
nn->dp.chained_metadata_format = nn->fw_ver.major == 4 ||
 !nn->dp.netdev ||
+!(nn->cap & NFP_NET_CFG_CTRL_RSS) ||
 nn->cap & NFP_NET_CFG_CTRL_CHAIN_META;
+   /* RSS(v1) uses non-chained metadata format, except in ABI 4.x where
+* it has the same meaning as RSSv2.
+*/
if (nn->dp.chained_metadata_format && nn->fw_ver.major != 4)
nn->cap &= ~NFP_NET_CFG_CTRL_RSS;
 
-- 
2.11.0

[PATCH net 3/3] net: hns: Fix a skb used after free bug

[Lin Yun Sheng]

From: Yunsheng Lin 

skb maybe freed in hns_nic_net_xmit_hw() and return NETDEV_TX_OK,
which cause hns_nic_net_xmit to use a freed skb.

BUG: KASAN: use-after-free in hns_nic_net_xmit_hw+0x62c/0x940...
[17659.112635]  alloc_debug_processing+0x18c/0x1a0
[17659.117208]  __slab_alloc+0x52c/0x560
[17659.120909]  kmem_cache_alloc_node+0xac/0x2c0
[17659.125309]  __alloc_skb+0x6c/0x260
[17659.128837]  tcp_send_ack+0x8c/0x280
[17659.132449]  __tcp_ack_snd_check+0x9c/0xf0
[17659.136587]  tcp_rcv_established+0x5a4/0xa70
[17659.140899]  tcp_v4_do_rcv+0x27c/0x620
[17659.144687]  tcp_prequeue_process+0x108/0x170
[17659.149085]  tcp_recvmsg+0x940/0x1020
[17659.152787]  inet_recvmsg+0x124/0x180
[17659.156488]  sock_recvmsg+0x64/0x80
[17659.160012]  SyS_recvfrom+0xd8/0x180
[17659.163626]  __sys_trace_return+0x0/0x4
[17659.167506] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=23 cpu=1 pid=13
[17659.174000]  free_debug_processing+0x1d4/0x2c0
[17659.178486]  __slab_free+0x240/0x390
[17659.182100]  kmem_cache_free+0x24c/0x270
[17659.186062]  kfree_skbmem+0xa0/0xb0
[17659.189587]  __kfree_skb+0x28/0x40
[17659.193025]  napi_gro_receive+0x168/0x1c0
[17659.197074]  hns_nic_rx_up_pro+0x58/0x90
[17659.201038]  hns_nic_rx_poll_one+0x518/0xbc0
[17659.205352]  hns_nic_common_poll+0x94/0x140
[17659.209576]  net_rx_action+0x458/0x5e0
[17659.213363]  __do_softirq+0x1b8/0x480
[17659.217062]  run_ksoftirqd+0x64/0x80
[17659.220679]  smpboot_thread_fn+0x224/0x310
[17659.224821]  kthread+0x150/0x170
[17659.228084]  ret_from_fork+0x10/0x40

BUG: KASAN: use-after-free in hns_nic_net_xmit+0x8c/0xc0...
[17751.080490]  __slab_alloc+0x52c/0x560
[17751.084188]  kmem_cache_alloc+0x244/0x280
[17751.088238]  __build_skb+0x40/0x150
[17751.091764]  build_skb+0x28/0x100
[17751.095115]  __alloc_rx_skb+0x94/0x150
[17751.098900]  __napi_alloc_skb+0x34/0x90
[17751.102776]  hns_nic_rx_poll_one+0x180/0xbc0
[17751.107097]  hns_nic_common_poll+0x94/0x140
[17751.111333]  net_rx_action+0x458/0x5e0
[17751.115123]  __do_softirq+0x1b8/0x480
[17751.118823]  run_ksoftirqd+0x64/0x80
[17751.122437]  smpboot_thread_fn+0x224/0x310
[17751.126575]  kthread+0x150/0x170
[17751.129838]  ret_from_fork+0x10/0x40
[17751.133454] INFO: Freed in kfree_skbmem+0xa0/0xb0 age=19 cpu=7 pid=43
[17751.139951]  free_debug_processing+0x1d4/0x2c0
[17751.144436]  __slab_free+0x240/0x390
[17751.148051]  kmem_cache_free+0x24c/0x270
[17751.152014]  kfree_skbmem+0xa0/0xb0
[17751.155543]  __kfree_skb+0x28/0x40
[17751.159022]  napi_gro_receive+0x168/0x1c0
[17751.163074]  hns_nic_rx_up_pro+0x58/0x90
[17751.167041]  hns_nic_rx_poll_one+0x518/0xbc0
[17751.171358]  hns_nic_common_poll+0x94/0x140
[17751.175585]  net_rx_action+0x458/0x5e0
[17751.179373]  __do_softirq+0x1b8/0x480
[17751.183076]  run_ksoftirqd+0x64/0x80
[17751.186691]  smpboot_thread_fn+0x224/0x310
[17751.190826]  kthread+0x150/0x170
[17751.194093]  ret_from_fork+0x10/0x40

Reported-by: Jun He 
Signed-off-by: lipeng 
Reviewed-by: Yunsheng Lin 
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c | 22 ++
 drivers/net/ethernet/hisilicon/hns/hns_enet.h |  6 +++---
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c 
b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index b1e7224..8dfc220 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -314,9 +314,9 @@ static void fill_tso_desc(struct hns_nic_ring_data 
*ring_data, void *priv,
 mtu);
 }
 
-int hns_nic_net_xmit_hw(struct net_device *ndev,
-   struct sk_buff *skb,
-   struct hns_nic_ring_data *ring_data)
+netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
+   struct sk_buff *skb,
+   struct hns_nic_ring_data *ring_data)
 {
struct hns_nic_priv *priv = netdev_priv(ndev);
struct hnae_ring *ring = ring_data->ring;
@@ -375,6 +375,10 @@ int hns_nic_net_xmit_hw(struct net_device *ndev,
dev_queue = netdev_get_tx_queue(ndev, skb->queue_mapping);
netdev_tx_sent_queue(dev_queue, skb->len);
 
+   netif_trans_update(ndev);
+   ndev->stats.tx_bytes += skb->len;
+   ndev->stats.tx_packets++;
+
   

[PATCH net 1/3] net: hns: Add TX CSUM check when fill TX description

[Lin Yun Sheng]

From: Yunsheng Lin 

If driver support checksum offload, should check netdev feature
before fill TX description and get CSUM err bit from RX
description. HNS driver do the check in RX derction but it doesn't
do the check in TX direction.

Signed-off-by: lipeng 
Reviewed-by: Daode Huang 
Reviewed-by: Yunsheng Lin 
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c | 36 +++
 drivers/net/ethernet/hisilicon/hns/hns_enet.h |  2 +-
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c 
b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index c6700b9..b1e7224 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -40,12 +40,14 @@
 #define SKB_TMP_LEN(SKB) \
(((SKB)->transport_header - (SKB)->mac_header) + tcp_hdrlen(SKB))
 
-static void fill_v2_desc(struct hnae_ring *ring, void *priv,
+static void fill_v2_desc(struct hns_nic_ring_data *ring_data, void *priv,
 int size, dma_addr_t dma, int frag_end,
 int buf_num, enum hns_desc_type type, int mtu)
 {
+   struct hnae_ring *ring = ring_data->ring;
struct hnae_desc *desc = &ring->desc[ring->next_to_use];
struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use];
+   struct net_device *ndev = ring_data->napi.dev;
struct iphdr *iphdr;
struct ipv6hdr *ipv6hdr;
struct sk_buff *skb;
@@ -90,8 +92,13 @@ static void fill_v2_desc(struct hnae_ring *ring, void *priv,
 
if (skb->protocol == htons(ETH_P_IP)) {
iphdr = ip_hdr(skb);
-   hnae_set_bit(rrcfv, HNSV2_TXD_L3CS_B, 1);
-   hnae_set_bit(rrcfv, HNSV2_TXD_L4CS_B, 1);
+
+   if (ndev->features & NETIF_F_IP_CSUM) {
+   hnae_set_bit(rrcfv, HNSV2_TXD_L3CS_B,
+1);
+   hnae_set_bit(rrcfv, HNSV2_TXD_L4CS_B,
+1);
+   }
 
/* check for tcp/udp header */
if (iphdr->protocol == IPPROTO_TCP &&
@@ -105,7 +112,10 @@ static void fill_v2_desc(struct hnae_ring *ring, void 
*priv,
} else if (skb->protocol == htons(ETH_P_IPV6)) {
hnae_set_bit(tvsvsn, HNSV2_TXD_IPV6_B, 1);
ipv6hdr = ipv6_hdr(skb);
-   hnae_set_bit(rrcfv, HNSV2_TXD_L4CS_B, 1);
+
+   if (ndev->features & NETIF_F_IPV6_CSUM)
+   hnae_set_bit(rrcfv, HNSV2_TXD_L4CS_B,
+1);
 
/* check for tcp/udp header */
if (ipv6hdr->nexthdr == IPPROTO_TCP &&
@@ -140,12 +150,14 @@ static void fill_v2_desc(struct hnae_ring *ring, void 
*priv,
 };
 MODULE_DEVICE_TABLE(acpi, hns_enet_acpi_match);
 
-static void fill_desc(struct hnae_ring *ring, void *priv,
+static void fill_desc(struct hns_nic_ring_data *ring_data, void *priv,
  int size, dma_addr_t dma, int frag_end,
  int buf_num, enum hns_desc_type type, int mtu)
 {
+   struct hnae_ring *ring = ring_data->ring;
struct hnae_desc *desc = &ring->desc[ring->next_to_use];
struct hnae_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_use];
+   struct net_device *ndev = ring_data->napi.dev;
struct sk_buff *skb;
__be16 protocol;
u32 ip_offset;
@@ -179,12 +191,14 @@ static void fill_desc(struct hnae_ring *ring, void *priv,
skb->protocol = protocol;
}
 
-   if (skb->protocol == htons(ETH_P_IP)) {
+   if (skb->protocol == htons(ETH_P_IP) &&
+   (ndev->features & NETIF_F_IP_CSUM)) {
flag_ipoffset |= 1 << HNS_TXD_L3CS_B;
/* check for tcp/udp header */
flag_ipoffset |= 1 << HNS_TXD_L4CS_B;
 
-   } else if (skb->protocol == htons(ETH_P_IPV6)) {
+   } else if (skb->protocol == htons(ETH_P_IPV6) &&
+  (ndev->features & NETIF_F_IPV6_CSUM)) {
/* ipv6 has not l3 cs, check for L4 header */
flag_ipoffset |= 1 << HNS_TXD_L4CS_B;
}
@@ -275,7 +289,7 @@ static int hns_nic_maybe_stop_tso(
return 0;
 }
 
-static void fill_tso_desc(struct hnae_ring *ring, void *priv,
+static void fill_tso_desc(struct hns_nic_ring_data *ring_data, void *priv,
  int size, dma_addr_

[PATCH net 2/3] net: hns: Fix a wrong op phy C45 code

[Lin Yun Sheng]

From: Yunsheng Lin 

As the user manual described, the second step to write to C45 phy
by mdio should be data, but not address. Here we should fix this
issue.

Signed-off-by: Yankejian 
Reviewed-by: lipeng 
Reviewed-by: Yunsheng Lin 
---
 drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c 
b/drivers/net/ethernet/hisilicon/hns_mdio.c
index e5221d9..017e084 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -261,7 +261,7 @@ static int hns_mdio_write(struct mii_bus *bus,
 
/* config the data needed writing */
cmd_reg_cfg = devad;
-   op = MDIO_C45_WRITE_ADDR;
+   op = MDIO_C45_WRITE_DATA;
}
 
MDIO_SET_REG_FIELD(mdio_dev, MDIO_WDATA_REG, MDIO_WDATA_DATA_M,
-- 
1.9.1

[PATCH net 0/3] Bugfixs for hns ethernet driver

[Lin Yun Sheng]

This patchset fix skb uesd after used, C45 op code and
Tx description filling issues in hns driver.

Yunsheng Lin (3):
  net: hns: Add TX CSUM check when fill TX description
  net: hns: Fix a wrong op phy C45 code
  net: hns: Fix a skb used after free bug

 drivers/net/ethernet/hisilicon/hns/hns_enet.c | 58 ---
 drivers/net/ethernet/hisilicon/hns/hns_enet.h |  8 ++--
 drivers/net/ethernet/hisilicon/hns_mdio.c |  2 +-
 3 files changed, 40 insertions(+), 28 deletions(-)

-- 
1.9.1

Re: [PATCH net 1/3] net: hns: Add TX CSUM check when fill TX description

[David Miller]

From: Lin Yun Sheng 
Date: Tue, 4 Jul 2017 18:47:31 +0800

> From: Yunsheng Lin 
> 
> If driver support checksum offload, should check netdev feature
> before fill TX description and get CSUM err bit from RX
> description. HNS driver do the check in RX derction but it doesn't
> do the check in TX direction.
> 
> Signed-off-by: lipeng 
> Reviewed-by: Daode Huang 
> Reviewed-by: Yunsheng Lin 

This is not correct.

You should be checking the skb->checksum field to decide if you should
offload the TX checksum of the packet or not.

Correct drivers, as far as I am aware, do not check the feature flags
so I wonder where you got this idea from.  Always use other well
established existing drivers as a model for how to handle things like
this.

And this makes sense.  An SKB can have it's checksumming determination
made first, then the netdev feature change is made afterwards.  For
correctness you still need to TX checksum offload that SKB otherwise
it will be emitted without a correctly computed checksum.

Thank you.

Re: [PATCH net 0/3] nfp: port enumeration change and FW ABI adjustment

[David Miller]

From: Jakub Kicinski 
Date: Tue,  4 Jul 2017 02:27:18 -0700

> This set changes the way ports are numbered internally to avoid MAC address
> changes and invalid link information when breakout is configured.  Second
> patch gets rid of old way of looking up MAC addresses in device information
> which caused all this confusion.
> 
> Patch 3 is a small adjustment to the new FW ABI version we introduced in
> this release cycle.
> 
> 
> To clarify these are intended for 4.13, naturally.

net-next is closed, and it looks like these are not really bug fixes
but a behavior adjustment and therefore more like a new feature.

Thanks.

[PATCH v1] ISDN: eicon: switch to use native bitmaps

[Andy Shevchenko]

Two arrays are clearly bit maps, so, make that explicit by converting to
bitmap API and remove custom helpers.

Note sig_ind() uses out of boundary bit to (looks like) protect against
potential bitmap_empty() checks for the same bitmap.

This patch removes that since:
1) that didn't guarantee atomicity anyway;
2) the first operation inside the for-loop is set bit in the bitmap
   (which effectively makes it non-empty);
3) group_optimization() doesn't utilize possible emptiness of the bitmap
   in question.

Thus, if there is a protection needed it should be implemented properly.

Signed-off-by: Andy Shevchenko 
---
 drivers/isdn/hardware/eicon/divacapi.h |  16 +--
 drivers/isdn/hardware/eicon/message.c  | 247 -
 2 files changed, 58 insertions(+), 205 deletions(-)

diff --git a/drivers/isdn/hardware/eicon/divacapi.h 
b/drivers/isdn/hardware/eicon/divacapi.h
index a315a2914d70..c4868a0d82f4 100644
--- a/drivers/isdn/hardware/eicon/divacapi.h
+++ b/drivers/isdn/hardware/eicon/divacapi.h
@@ -26,15 +26,7 @@
 
 /*#define DEBUG */
 
-
-
-
-
-
-
-
-
-
+#include 
 
 #define IMPLEMENT_DTMF 1
 #define IMPLEMENT_LINE_INTERCONNECT2 1
@@ -82,8 +74,6 @@
 #define CODEC_PERMANENT0x02
 #define ADV_VOICE  0x03
 #define MAX_CIP_TYPES  5  /* kind of CIP types for group optimization */
-#define C_IND_MASK_DWORDS  ((MAX_APPL + 32) >> 5)
-
 
 #define FAX_CONNECT_INFO_BUFFER_SIZE  256
 #define NCPI_BUFFER_SIZE  256
@@ -265,8 +255,8 @@ struct _PLCI {
word  ncci_ring_list;
byte  inc_dis_ncci_table[MAX_CHANNELS_PER_PLCI];
t_std_internal_command 
internal_command_queue[MAX_INTERNAL_COMMAND_LEVELS];
-   dword c_ind_mask_table[C_IND_MASK_DWORDS];
-   dword group_optimization_mask_table[C_IND_MASK_DWORDS];
+   DECLARE_BITMAP(c_ind_mask_table, MAX_APPL);
+   DECLARE_BITMAP(group_optimization_mask_table, MAX_APPL);
byte  RBuffer[200];
dword msg_in_queue[MSG_IN_QUEUE_SIZE/sizeof(dword)];
API_SAVE  saved_msg;
diff --git a/drivers/isdn/hardware/eicon/message.c 
b/drivers/isdn/hardware/eicon/message.c
index 3b11422b1cce..eadd1ed1e014 100644
--- a/drivers/isdn/hardware/eicon/message.c
+++ b/drivers/isdn/hardware/eicon/message.c
@@ -23,9 +23,7 @@
  *
  */
 
-
-
-
+#include 
 
 #include "platform.h"
 #include "di_defs.h"
@@ -35,19 +33,9 @@
 #include "mdm_msg.h"
 #include "divasync.h"
 
-
-
 #define FILE_ "MESSAGE.C"
 #define dprintf
 
-
-
-
-
-
-
-
-
 /*--*/
 /* This is options supported for all adapters that are server by*/
 /* XDI driver. Allo it is not necessary to ask it from every adapter*/
@@ -72,9 +60,6 @@ static dword diva_xdi_extended_features = 0;
 /*--*/
 
 static void group_optimization(DIVA_CAPI_ADAPTER *a, PLCI *plci);
-static void set_group_ind_mask(PLCI *plci);
-static void clear_group_ind_mask_bit(PLCI *plci, word b);
-static byte test_group_ind_mask_bit(PLCI *plci, word b);
 void AutomaticLaw(DIVA_CAPI_ADAPTER *);
 word CapiRelease(word);
 word CapiRegister(word);
@@ -1087,106 +1072,6 @@ static void plci_remove(PLCI *plci)
 }
 
 /*--*/
-/* Application Group function helpers   */
-/*--*/
-
-static void set_group_ind_mask(PLCI *plci)
-{
-   word i;
-
-   for (i = 0; i < C_IND_MASK_DWORDS; i++)
-   plci->group_optimization_mask_table[i] = 0xL;
-}
-
-static void clear_group_ind_mask_bit(PLCI *plci, word b)
-{
-   plci->group_optimization_mask_table[b >> 5] &= ~(1L << (b & 0x1f));
-}
-
-static byte test_group_ind_mask_bit(PLCI *plci, word b)
-{
-   return ((plci->group_optimization_mask_table[b >> 5] & (1L << (b & 
0x1f))) != 0);
-}
-
-/*--*/
-/* c_ind_mask operations for arbitrary MAX_APPL */
-/*--*/
-
-static void clear_c_ind_mask(PLCI *plci)
-{
-   word i;
-
-   for (i = 0; i < C_IND_MASK_DWORDS; i++)
-   plci->c_ind_mask_table[i] = 0;
-}
-
-static byte c_ind_mask_empty(PLCI *plci)
-{
-   word i;
-
-   i = 0;
-   while ((i < C_IND_MASK_DWORDS) && (plci->c_ind_mask_table[i] == 0))
-   i++;
-   return (i == C_IND_MASK_DWORDS);
-}
-
-static void set_c_ind_mask_bit(PLCI *plci, word b)
-{
-   plci->c_ind_mask_table[b >> 5] |= (1L << (b & 0x1f));
-}
-
-static void clear_c_ind_mask_bit(PLCI *plci, word b)
-{
-   plci->c_ind_mask_table[b >> 5] &= ~(1L << (b & 0x1f));
-}
-
-static byte test_c_ind_mask_bit(PLCI *plci, word b)
-{
-   return ((plci->c_ind_mask_table[b >> 5] & (1L << (b & 0x1f))) != 0);
-}
-
-static void dump_c_ind_mask(PLCI *plci)

Re: [PATCH v1] ISDN: eicon: switch to use native bitmaps

[David Miller]

From: Andy Shevchenko 
Date: Tue,  4 Jul 2017 13:34:51 +0300

> Two arrays are clearly bit maps, so, make that explicit by converting to
> bitmap API and remove custom helpers.
> 
> Note sig_ind() uses out of boundary bit to (looks like) protect against
> potential bitmap_empty() checks for the same bitmap.
> 
> This patch removes that since:
> 1) that didn't guarantee atomicity anyway;
> 2) the first operation inside the for-loop is set bit in the bitmap
>(which effectively makes it non-empty);
> 3) group_optimization() doesn't utilize possible emptiness of the bitmap
>in question.
> 
> Thus, if there is a protection needed it should be implemented properly.
> 
> Signed-off-by: Andy Shevchenko 

net-next is closed, please submit this when net-next opens back up.

Thank you.

[PATCH 0/2] net: phy: dp83867: workaround incorrect RX_CTRL pin strap

[Sekhar Nori]

Hi,

This patch series adds workaround for incorrect RX_CTRL pin strap
setting that can be found on some TI boards.

This is required to be complaint to PHY datamanual specification.

Murali Karicheri (2):
  dt-bindings: phy: dp83867: provide a workaround for incorrect RX_CTRL
pin strap
  net: phy: dp83867: add workaround for incorrect RX_CTRL pin strap

 Documentation/devicetree/bindings/net/ti,dp83867.txt |  7 +++
 drivers/net/phy/dp83867.c| 11 +++
 2 files changed, 18 insertions(+)

-- 
2.9.0

[PATCH 2/2] net: phy: dp83867: add workaround for incorrect RX_CTRL pin strap

[Sekhar Nori]

From: Murali Karicheri 

The data manual for DP83867IR/CR, SNLS484E[1], revised march 2017,
advises that strapping RX_DV/RX_CTRL pin in mode 1 and 2 is not
supported (see note below Table 5 (4-Level Strap Pins)).

There are some boards which have the pin strapped this way and need
software workaround suggested by the data manual. Bit[7] of
Configuration Register 4 (address 0x0031) must be cleared to 0. This
ensures proper operation of the PHY.

Implement driver support for device-tree property meant to advertise
the wrong strapping.

[1] http://www.ti.com/lit/ds/snls484e/snls484e.pdf

Signed-off-by: Murali Karicheri 
[nsek...@ti.com: rebase to mainline, code simplification]
Signed-off-by: Sekhar Nori 
---
 drivers/net/phy/dp83867.c | 11 +++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
index b57f20e552ba..c1ab976cc800 100644
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -91,6 +91,7 @@ struct dp83867_private {
int fifo_depth;
int io_impedance;
int port_mirroring;
+   bool rxctrl_strap_quirk;
 };
 
 static int dp83867_ack_interrupt(struct phy_device *phydev)
@@ -164,6 +165,9 @@ static int dp83867_of_init(struct phy_device *phydev)
else if (of_property_read_bool(of_node, "ti,min-output-impedance"))
dp83867->io_impedance = DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN;
 
+   dp83867->rxctrl_strap_quirk = of_property_read_bool(of_node,
+   "ti,dp83867-rxctrl-strap-quirk");
+
ret = of_property_read_u32(of_node, "ti,rx-internal-delay",
   &dp83867->rx_id_delay);
if (ret &&
@@ -214,6 +218,13 @@ static int dp83867_config_init(struct phy_device *phydev)
dp83867 = (struct dp83867_private *)phydev->priv;
}
 
+   /* RX_DV/RX_CTRL strapped in mode 1 or mode 2 workaround */
+   if (dp83867->rxctrl_strap_quirk) {
+   val = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4);
+   val &= ~BIT(7);
+   phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4, val);
+   }
+
if (phy_interface_is_rgmii(phydev)) {
val = phy_read(phydev, MII_DP83867_PHYCTRL);
if (val < 0)
-- 
2.9.0

[PATCH 1/2] dt-bindings: phy: dp83867: provide a workaround for incorrect RX_CTRL pin strap

[Sekhar Nori]

From: Murali Karicheri 

The data manual for DP83867IR/CR, SNLS484E[1], revised march 2017,
advises that strapping RX_DV/RX_CTRL pin in mode 1 and 2 is not
supported (see note below Table 5 (4-Level Strap Pins)).

It further advises that if a board has this pin strapped in mode 1 and
mode 2, then to ensure proper operation of the PHY, a software workaround
must be implemented.

Since it is not possible to detect in software if RX_DV/RX_CTRL pin is
incorrectly strapped, add a device-tree property for the board to
advertise this and allow corrective action in software.

[1] http://www.ti.com/lit/ds/snls484e/snls484e.pdf

Signed-off-by: Murali Karicheri 
[nsek...@ti.com: rebase to mainline, split documentation into separate patch]
Signed-off-by: Sekhar Nori 
---
 Documentation/devicetree/bindings/net/ti,dp83867.txt | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/Documentation/devicetree/bindings/net/ti,dp83867.txt 
b/Documentation/devicetree/bindings/net/ti,dp83867.txt
index afe9630a5e7d..02c4353b5cf2 100644
--- a/Documentation/devicetree/bindings/net/ti,dp83867.txt
+++ b/Documentation/devicetree/bindings/net/ti,dp83867.txt
@@ -18,6 +18,13 @@ Optional property:
- ti,max-output-impedance - MAC Interface Impedance control to set
the programmable output impedance to
maximum value (70 ohms).
+   - ti,dp83867-rxctrl-strap-quirk - This denotes the fact that the
+   board has RX_DV/RX_CTRL pin strapped in
+   mode 1 or 2. To ensure PHY operation,
+   there are specific actions that
+   software needs to take when this pin is
+   strapped in these modes. See data manual
+   for details.
 
 Note: ti,min-output-impedance and ti,max-output-impedance are mutually
   exclusive. When both properties are present ti,max-output-impedance
-- 
2.9.0

[PATCH net-next 0/3] cxgb4: Add PTP Hardware Clock (PHC) support

[Atul Gupta]

V4:
Splitting the patch again
V3:
Releasing lock in the exit paths
V2:
Splitting the patch


Atul Gupta (3):
  cxgb4: time stamping interface for PTP
  cxgb4: Add PTP Hardware Clock (PHC) support
  cxgb4: Support for get_ts_info ethtool method

 drivers/net/ethernet/chelsio/cxgb4/Makefile|   2 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4.h |   9 +
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c |  19 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c|  82 +++-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 475 +
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.h |  74 
 drivers/net/ethernet/chelsio/cxgb4/sge.c   | 173 +++-
 drivers/net/ethernet/chelsio/cxgb4/t4_msg.h|  28 ++
 drivers/net/ethernet/chelsio/cxgb4/t4_regs.h   |   2 +
 drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h  |  50 +++
 10 files changed, 900 insertions(+), 14 deletions(-)
 create mode 100644 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
 create mode 100644 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.h

-- 
1.8.3.1

[PATCH net-next 2/3] cxgb4: Add PTP Hardware Clock (PHC) support

[Atul Gupta]

Add PTP IEEE-1588 support and make it accessible via PHC subsystem.
The functionality is enabled for T5/T6 adapters. Driver interfaces with
Firmware to program and adjust the clock offset.

Cc: Richard Cochran 
Signed-off-by: Atul Gupta 
Signed-off-by: Ganesh Goudar 
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c |   6 +
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c  | 281 
 2 files changed, 287 insertions(+)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c 
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 584aa60..86f92e3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -5202,6 +5202,9 @@ static int init_one(struct pci_dev *pdev, const struct 
pci_device_id *ent)
mutex_unlock(&uld_mutex);
}
 
+   if (!is_t4(adapter->params.chip))
+   cxgb4_ptp_init(adapter);
+
print_adapter_info(adapter);
setup_fw_sge_queues(adapter);
return 0;
@@ -5311,6 +5314,9 @@ static void remove_one(struct pci_dev *pdev)
 
debugfs_remove_recursive(adapter->debugfs_root);
 
+   if (!is_t4(adapter->params.chip))
+   cxgb4_ptp_stop(adapter);
+
/* If we allocated filters, free up state associated with any
 * valid filters ...
 */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c 
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
index 0efcbad..50517cf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
@@ -192,3 +192,284 @@ int cxgb4_ptp_redirect_rx_packet(struct adapter *adapter, 
struct port_info *pi)
"PTP: %s error %d\n", __func__, -err);
return err;
 }
+
+/**
+ * @ptp: ptp clock structure
+ * @ppb: Desired frequency change in parts per billion
+ *
+ * Adjust the frequency of the PHC cycle counter by the indicated ppb from
+ * the base frequency.
+ */
+static int cxgb4_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
+{
+   struct adapter *adapter = (struct adapter *)container_of(ptp,
+  struct adapter, ptp_clock_info);
+   struct fw_ptp_cmd c;
+   int err;
+
+   memset(&c, 0, sizeof(c));
+   c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) |
+FW_CMD_REQUEST_F |
+FW_CMD_WRITE_F |
+FW_PTP_CMD_PORTID_V(0));
+   c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16));
+   c.u.ts.sc = FW_PTP_SC_ADJ_FREQ;
+   c.u.ts.sign = (ppb < 0) ? 1 : 0;
+   if (ppb < 0)
+   ppb = -ppb;
+   c.u.ts.ppb = cpu_to_be32(ppb);
+
+   err = t4_wr_mbox(adapter, adapter->mbox, &c, sizeof(c), NULL);
+   if (err < 0)
+   dev_err(adapter->pdev_dev,
+   "PTP: %s error %d\n", __func__, -err);
+
+   return err;
+}
+
+/**
+ * cxgb4_ptp_fineadjtime - Shift the time of the hardware clock
+ * @ptp: ptp clock structure
+ * @delta: Desired change in nanoseconds
+ *
+ * Adjust the timer by resetting the timecounter structure.
+ */
+static int  cxgb4_ptp_fineadjtime(struct adapter *adapter, s64 delta)
+{
+   struct fw_ptp_cmd c;
+   int err;
+
+   memset(&c, 0, sizeof(c));
+   c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) |
+FW_CMD_REQUEST_F |
+FW_CMD_WRITE_F |
+FW_PTP_CMD_PORTID_V(0));
+   c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16));
+   c.u.ts.sc = FW_PTP_SC_ADJ_FTIME;
+   c.u.ts.tm = cpu_to_be64(delta);
+
+   err = t4_wr_mbox(adapter, adapter->mbox, &c, sizeof(c), NULL);
+   if (err < 0)
+   dev_err(adapter->pdev_dev,
+   "PTP: %s error %d\n", __func__, -err);
+   return err;
+}
+
+/**
+ * cxgb4_ptp_adjtime - Shift the time of the hardware clock
+ * @ptp: ptp clock structure
+ * @delta: Desired change in nanoseconds
+ *
+ * Adjust the timer by resetting the timecounter structure.
+ */
+static int cxgb4_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
+{
+   struct adapter *adapter =
+   (struct adapter *)container_of(ptp, struct adapter,
+  ptp_clock_info);
+   struct fw_ptp_cmd c;
+   s64 sign = 1;
+   int err;
+
+   if (delta < 0)
+   sign = -1;
+
+   if (delta * sign > PTP_CLOCK_MAX_ADJTIME) {
+   memset(&c, 0, sizeof(c));
+   c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) |
+FW_CMD_REQUEST_F |
+FW_CMD_WRITE_F |
+FW_PTP_CMD_PORTID_V(0));
+   c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16));
+  

[PATCH net-next 3/3] cxgb4: Support for get_ts_info ethtool method

[Atul Gupta]

Cc: Richard Cochran 
Signed-off-by: Atul Gupta 
Signed-off-by: Ganesh Goudar 
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 19 ++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c 
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
index e9bab72..26eb00a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
@@ -1113,14 +1113,31 @@ static int set_flash(struct net_device *netdev, struct 
ethtool_flash *ef)
 
 static int get_ts_info(struct net_device *dev, struct ethtool_ts_info *ts_info)
 {
+   struct port_info *pi = netdev_priv(dev);
+   struct  adapter *adapter = pi->adapter;
+
ts_info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE |
   SOF_TIMESTAMPING_RX_SOFTWARE |
   SOF_TIMESTAMPING_SOFTWARE;
 
ts_info->so_timestamping |= SOF_TIMESTAMPING_RX_HARDWARE |
+   SOF_TIMESTAMPING_TX_HARDWARE |
SOF_TIMESTAMPING_RAW_HARDWARE;
 
-   ts_info->phc_index = -1;
+   ts_info->tx_types = (1 << HWTSTAMP_TX_OFF) |
+   (1 << HWTSTAMP_TX_ON);
+
+   ts_info->rx_filters = (1 << HWTSTAMP_FILTER_NONE) |
+ (1 << HWTSTAMP_FILTER_PTP_V2_L4_EVENT) |
+ (1 << HWTSTAMP_FILTER_PTP_V1_L4_SYNC) |
+ (1 << HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ) |
+ (1 << HWTSTAMP_FILTER_PTP_V2_L4_SYNC) |
+ (1 << HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ);
+
+   if (adapter->ptp_clock)
+   ts_info->phc_index = ptp_clock_index(adapter->ptp_clock);
+   else
+   ts_info->phc_index = -1;
 
return 0;
 }
-- 
1.8.3.1

[PATCH net-next 1/3] cxgb4: time stamping interface for PTP

[Atul Gupta]

Supports hardware and software time stamping via the
Linux SO_TIMESTAMPING socket option.

Cc: Richard Cochran 
Signed-off-by: Atul Gupta 
Signed-off-by: Ganesh Goudar 
---
 drivers/net/ethernet/chelsio/cxgb4/Makefile |   2 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4.h  |   9 ++
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c |  76 +-
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c  | 194 
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.h  |  74 +
 drivers/net/ethernet/chelsio/cxgb4/sge.c| 173 -
 drivers/net/ethernet/chelsio/cxgb4/t4_msg.h |  28 
 drivers/net/ethernet/chelsio/cxgb4/t4_regs.h|   2 +
 drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h   |  50 ++
 9 files changed, 595 insertions(+), 13 deletions(-)
 create mode 100644 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
 create mode 100644 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.h

diff --git a/drivers/net/ethernet/chelsio/cxgb4/Makefile 
b/drivers/net/ethernet/chelsio/cxgb4/Makefile
index c6b71f6..8172127 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/Makefile
+++ b/drivers/net/ethernet/chelsio/cxgb4/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_CHELSIO_T4) += cxgb4.o
 
-cxgb4-objs := cxgb4_main.o l2t.o t4_hw.o sge.o clip_tbl.o cxgb4_ethtool.o 
cxgb4_uld.o sched.o cxgb4_filter.o cxgb4_tc_u32.o
+cxgb4-objs := cxgb4_main.o l2t.o t4_hw.o sge.o clip_tbl.o cxgb4_ethtool.o 
cxgb4_uld.o sched.o cxgb4_filter.o cxgb4_tc_u32.o cxgb4_ptp.o
 cxgb4-$(CONFIG_CHELSIO_T4_DCB) +=  cxgb4_dcb.o
 cxgb4-$(CONFIG_CHELSIO_T4_FCOE) +=  cxgb4_fcoe.o
 cxgb4-$(CONFIG_DEBUG_FS) += cxgb4_debugfs.o
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h 
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 451c138..dd6e5a3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -48,6 +48,8 @@
 #include 
 #include 
 #include 
+#include 
+#include 
 #include 
 #include "t4_chip_type.h"
 #include "cxgb4_uld.h"
@@ -510,6 +512,7 @@ struct port_info {
 #endif /* CONFIG_CHELSIO_T4_FCOE */
bool rxtstamp;  /* Enable TS */
struct hwtstamp_config tstamp_config;
+   bool ptp_enable;
struct sched_table *sched_tbl;
 };
 
@@ -705,6 +708,7 @@ struct sge_uld_txq_info {
 
 struct sge {
struct sge_eth_txq ethtxq[MAX_ETH_QSETS];
+   struct sge_eth_txq ptptxq;
struct sge_ctrl_txq ctrlq[MAX_CTRL_QUEUES];
 
struct sge_eth_rxq ethrxq[MAX_ETH_QSETS];
@@ -869,6 +873,11 @@ struct adapter {
 * used for all 4 filters.
 */
 
+   struct ptp_clock *ptp_clock;
+   struct ptp_clock_info ptp_clock_info;
+   struct sk_buff *ptp_tx_skb;
+   /* ptp lock */
+   spinlock_t ptp_lock;
spinlock_t stats_lock;
spinlock_t win0_lock cacheline_aligned_in_smp;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c 
b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index f41507e..584aa60 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -79,6 +79,7 @@
 #include "l2t.h"
 #include "sched.h"
 #include "cxgb4_tc_u32.h"
+#include "cxgb4_ptp.h"
 
 char cxgb4_driver_name[] = KBUILD_MODNAME;
 
@@ -872,6 +873,14 @@ static int setup_sge_queues(struct adapter *adap)
goto freeout;
}
 
+   if (!is_t4(adap->params.chip)) {
+   err = t4_sge_alloc_eth_txq(adap, &s->ptptxq, adap->port[0],
+  netdev_get_tx_queue(adap->port[0], 0)
+  , s->fw_evtq.cntxt_id);
+   if (err)
+   goto freeout;
+   }
+
t4_write_reg(adap, is_t4(adap->params.chip) ?
MPS_TRC_RSS_CONTROL_A :
MPS_T5_TRC_RSS_CONTROL_A,
@@ -2438,6 +2447,7 @@ static int cxgb_ioctl(struct net_device *dev, struct 
ifreq *req, int cmd)
unsigned int mbox;
int ret = 0, prtad, devad;
struct port_info *pi = netdev_priv(dev);
+   struct adapter *adapter = pi->adapter;
struct mii_ioctl_data *data = (struct mii_ioctl_data *)&req->ifr_data;
 
switch (cmd) {
@@ -2475,18 +2485,69 @@ static int cxgb_ioctl(struct net_device *dev, struct 
ifreq *req, int cmd)
   sizeof(pi->tstamp_config)))
return -EFAULT;
 
-   switch (pi->tstamp_config.rx_filter) {
-   case HWTSTAMP_FILTER_NONE:
+   if (!is_t4(adapter->params.chip)) {
+   switch (pi->tstamp_config.tx_type) {
+   case HWTSTAMP_TX_OFF:
+   case HWTSTAMP_TX_ON:
+   break;
+   default:
+   return -ERANGE;
+   }
+
+   switch (pi->tstamp_config.rx_filter) {
+

Re: [PATCH net] virtio-net: unbreak cusmed packet for small buffer XDP

[Jason Wang]

On 2017年07月04日 01:03, Michael S. Tsirkin wrote:

On Wed, Jun 28, 2017 at 08:05:06PM +0800, Jason Wang wrote:


On 2017年06月28日 12:01, Michael S. Tsirkin wrote:

On Wed, Jun 28, 2017 at 11:40:30AM +0800, Jason Wang wrote:

On 2017年06月28日 11:31, Michael S. Tsirkin wrote:

On Wed, Jun 28, 2017 at 10:45:18AM +0800, Jason Wang wrote:

On 2017年06月28日 10:17, Michael S. Tsirkin wrote:

On Wed, Jun 28, 2017 at 10:14:34AM +0800, Jason Wang wrote:

On 2017年06月28日 10:02, Michael S. Tsirkin wrote:

On Wed, Jun 28, 2017 at 09:54:03AM +0800, Jason Wang wrote:

We should allow csumed packet for small buffer, otherwise XDP_PASS
won't work correctly.

Fixes commit bb91accf2733 ("virtio-net: XDP support for small buffers")
Signed-off-by: Jason Wang

The issue would be VIRTIO_NET_HDR_F_DATA_VALID might be set.
What do you think?

I think it's safe. For XDP_PASS, it work like in the past.

That's the part I don't get. With DATA_VALID csum in packet is wrong, XDP
tools assume it's value.

DATA_VALID is CHECKSUM_UNCESSARY on the host, and according to the comment
in skbuff.h


"
*   The hardware you're dealing with doesn't calculate the full checksum
*   (as in CHECKSUM_COMPLETE), but it does parse headers and verify
checksums
*   for specific protocols. For such packets it will set
CHECKSUM_UNNECESSARY
*   if their checksums are okay. skb->csum is still undefined in this case
*   though. A driver or device must never modify the checksum field in the
*   packet even if checksum is verified.
"

The csum is correct I believe?

Thanks

That's on input. But I think for tun it's output, where that is equivalent
to CHECKSUM_NONE



Yes, but the comment said:

"
CKSUM_NONE:
   *
   *   The skb was already checksummed by the protocol, or a checksum is not
   *   required.
   *
   * CHECKSUM_UNNECESSARY:
   *
   *   This has the same meaning on as CHECKSUM_NONE for checksum offload on
   *   output.
   *
"

So still correct I think?

Thanks

Hmm maybe I mean NEEDS_CHECKSUM actually.

I'll need to re-read the spec.


Not sure this is an issue. But if it is, we can probably checksum the packet
before passing it to XDP. But it would be a little slow.

Thanks



Right. I confused DATA_VALID with NEEDS_CHECKSUM.

IIUC XDP generally refuses to attach if checksum offload
is enabled.


Any reason to do this? (Looks like I don't see any code for this)



Could you pls explain how to reproduce the issue you are seeing?



Using small buffer, all csumed packets will be dropped.

Thanks

[PATCH 00/36] v2 net subsystem misc refcounter conversions

[Elena Reshetova]

Changes in v2:
 * rebase on top of net-next
 * currently by default refcount_t = atomic_t (*) and uses all 
   atomic standard operations unless CONFIG_REFCOUNT_FULL is enabled.
   This is a compromise for the systems that are critical on
   performance (such as net) and cannot accept even slight delay
   on the refcounter operations.

This series, for various misc network components, replaces atomic_t reference
counters with the new refcount_t type and API (see include/linux/refcount.h).
By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.
These are the last networking-related conversions with the exception of
network drivers (to be send separately).

Please excuse the long patch set, but seems like breaking it up
won't save that much on CC list and most of the changes are
trivial.

The patches are fully independent and can be cherry-picked separately.
In order to try with refcount functionality enabled in run-time,
CONFIG_REFCOUNT_FULL must be enabled.

NOTE: automatic kernel builder for some reason doesn't like all my
network branches and regularly times out the builds on these branches.
Suggestion for "waiting a day for a good coverage" doesn't work, as
we have seen with generic network conversions. So please wait for the
full report from kernel test rebot before merging further up.
This has been compile-tested in 116 configs, but 71 timed out (including
all s390-related configs again). I am trying to see if they can fix
build coverage for me in meanwhile.

* The respective change is currently merged into -next as
  "locking/refcount: Create unchecked atomic_t implementation".

Elena Reshetova (36):
  net, llc: convert llc_sap.refcnt from atomic_t to refcount_t
  net, l2tp: convert l2tp_tunnel.ref_count from atomic_t to refcount_t
  net, l2tp: convert l2tp_session.ref_count from atomic_t to refcount_t
  net, vxlan: convert vxlan_sock.refcnt from atomic_t to refcount_t
  net, decnet: convert dn_fib_info.fib_clntref from atomic_t to
refcount_t
  net, atm: convert atm_dev.refcnt from atomic_t to refcount_t
  net, atm: convert lec_arp_table.usage from atomic_t to refcount_t
  net, atm: convert in_cache_entry.use from atomic_t to refcount_t
  net, atm: convert eg_cache_entry.use from atomic_t to refcount_t
  net, bridge: convert net_bridge_vlan.refcnt from atomic_t to
refcount_t
  net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t
  net, sched: convert Qdisc.refcnt from atomic_t to refcount_t
  net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t
  net, ipx: convert ipx_interface.refcnt from atomic_t to refcount_t
  net, ipx: convert ipx_route.refcnt from atomic_t to refcount_t
  net, netrom: convert nr_neigh.refcount from atomic_t to refcount_t
  net, netrom: convert nr_node.refcount from atomic_t to refcount_t
  net, sunrpc: convert gss_cl_ctx.count from atomic_t to refcount_t
  net, sunrpc: convert gss_upcall_msg.count from atomic_t to refcount_t
  net, rds: convert rds_ib_device.refcount from atomic_t to refcount_t
  net, rds: convert rds_incoming.i_refcount from atomic_t to refcount_t
  net, rds: convert rds_mr.r_refcount from atomic_t to refcount_t
  net, rds: convert rds_message.m_refcount from atomic_t to refcount_t
  net, x25: convert x25_route.refcnt from atomic_t to refcount_t
  net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t
  net, xfrm: convert xfrm_state.refcnt from atomic_t to refcount_t
  net, xfrm: convert xfrm_policy.refcnt from atomic_t to refcount_t
  net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_datamsg.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_transport.refcnt from atomic_t to refcount_t
  net, sctp: convert sctp_ep_common.refcnt from atomic_t to refcount_t
  net, ax25: convert ax25_uid_assoc.refcount from atomic_t to refcount_t
  net, ax25: convert ax25_route.refcount from atomic_t to refcount_t
  net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t

 drivers/net/vxlan.c | 10 +-
 include/linux/atmdev.h  |  7 ---
 include/linux/sunrpc/auth_gss.h |  3 ++-
 include/net/ax25.h  | 20 ++--
 include/net/calipso.h   |  4 ++--
 include/net/dn_fib.h|  5 +++--
 include/net/ipx.h   | 13 +++--
 include/net/lapb.h  |  3 ++-
 include/net/llc.h   |  6 +++---
 include/net/netrom.h| 13 +++--
 include/net/sch_generic.h   |  3 ++-
 include/net/sctp/auth.h |  5 +++--
 include/net/sctp/structs.h  |  8 
 include/net/vxlan.h |  2 +-
 include/net/x25.h   | 13 +++--
 include/net/xfrm.h  | 21 +++--
 net/atm/lec.c   |  6 +++---
 net/atm/lec_arpc

[PATCH 02/36] net, l2tp: convert l2tp_tunnel.ref_count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/l2tp/l2tp_core.c| 14 +++---
 net/l2tp/l2tp_core.h|  3 ++-
 net/l2tp/l2tp_debugfs.c |  4 ++--
 net/l2tp/l2tp_ppp.c |  2 +-
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index fa03425..203c4aa 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -132,12 +132,12 @@ static inline struct l2tp_net *l2tp_pernet(const struct 
net *net)
  */
 static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
 {
-   atomic_inc(&tunnel->ref_count);
+   refcount_inc(&tunnel->ref_count);
 }
 
 static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
 {
-   if (atomic_dec_and_test(&tunnel->ref_count))
+   if (refcount_dec_and_test(&tunnel->ref_count))
l2tp_tunnel_free(tunnel);
 }
 #ifdef L2TP_REFCNT_DEBUG
@@ -145,14 +145,14 @@ static inline void l2tp_tunnel_dec_refcount_1(struct 
l2tp_tunnel *tunnel)
 do {   \
pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n",\
 __func__, __LINE__, (_t)->name,\
-atomic_read(&_t->ref_count));  \
+refcount_read(&_t->ref_count));\
l2tp_tunnel_inc_refcount_1(_t); \
 } while (0)
 #define l2tp_tunnel_dec_refcount(_t)   \
 do {   \
pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n",\
 __func__, __LINE__, (_t)->name,\
-atomic_read(&_t->ref_count));  \
+refcount_read(&_t->ref_count));\
l2tp_tunnel_dec_refcount_1(_t); \
 } while (0)
 #else
@@ -1353,7 +1353,7 @@ static void l2tp_udp_encap_destroy(struct sock *sk)
  */
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
 {
-   BUG_ON(atomic_read(&tunnel->ref_count) != 0);
+   BUG_ON(refcount_read(&tunnel->ref_count) != 0);
BUG_ON(tunnel->sock != NULL);
l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
kfree_rcu(tunnel, rcu);
@@ -1667,7 +1667,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int 
version, u32 tunnel_id, u32
/* Bump the reference count. The tunnel context is deleted
 * only when this drops to zero. Must be done before list insertion
 */
-   l2tp_tunnel_inc_refcount(tunnel);
+   refcount_set(&tunnel->ref_count, 1);
spin_lock_bh(&pn->l2tp_tunnel_list_lock);
list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1706,7 +1706,7 @@ void l2tp_session_free(struct l2tp_session *session)
 {
struct l2tp_tunnel *tunnel = session->tunnel;
 
-   BUG_ON(atomic_read(&session->ref_count) != 0);
+   BUG_ON(refcount_read(&session->ref_count) != 0);
 
if (tunnel) {
BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index eec5ad2..da58fad 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -7,6 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include 
 
 #ifndef _L2TP_CORE_H_
 #define _L2TP_CORE_H_
@@ -177,7 +178,7 @@ struct l2tp_tunnel {
struct list_headlist;   /* Keep a list of all tunnels */
struct net  *l2tp_net;  /* the net we belong to */
 
-   atomic_tref_count;
+   refcount_t  ref_count;
 #ifdef CONFIG_DEBUG_FS
void (*show)(struct seq_file *m, void *arg);
 #endif
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 98a005d..53bae54 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -145,7 +145,7 @@ static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, 
void *v)
   "");
seq_printf(m, " %d sessions, refcnt %d/%d\n", session_count,
   tunnel->sock ? refcount_read(&tunnel->sock->sk_refcnt) : 0,
-  atomic_read(&tunnel->ref_count));
+  refcount_read(&tunnel->ref_count));
seq_printf(m, " %08x rx %ld/%ld/%ld rx %ld/%ld/%ld\n",
   tunnel->debug,
   atomic_long_read(&tunnel->stats.tx_packets),
@@ -170,7 +170,7 @@ static void l2tp_dfs_seq_session_show(struct seq_file *m, 
v

[PATCH 01/36] net, llc: convert llc_sap.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/llc.h  | 6 +++---
 net/llc/llc_core.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/llc.h b/include/net/llc.h
index e8e61d4..dc35f25 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -55,7 +55,7 @@ struct llc_sap {
unsigned charstate;
unsigned charp_bit;
unsigned charf_bit;
-   atomic_t refcnt;
+   refcount_t   refcnt;
int  (*rcv_func)(struct sk_buff *skb,
 struct net_device *dev,
 struct packet_type *pt,
@@ -113,14 +113,14 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
struct net_device *orig_dev));
 static inline void llc_sap_hold(struct llc_sap *sap)
 {
-   atomic_inc(&sap->refcnt);
+   refcount_inc(&sap->refcnt);
 }
 
 void llc_sap_close(struct llc_sap *sap);
 
 static inline void llc_sap_put(struct llc_sap *sap)
 {
-   if (atomic_dec_and_test(&sap->refcnt))
+   if (refcount_dec_and_test(&sap->refcnt))
llc_sap_close(sap);
 }
 
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 842851c..8904126 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -41,7 +41,7 @@ static struct llc_sap *llc_sap_alloc(void)
spin_lock_init(&sap->sk_lock);
for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++)
INIT_HLIST_NULLS_HEAD(&sap->sk_laddr_hash[i], i);
-   atomic_set(&sap->refcnt, 1);
+   refcount_set(&sap->refcnt, 1);
}
return sap;
 }
-- 
2.7.4

[PATCH 04/36] net, vxlan: convert vxlan_sock.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/net/vxlan.c | 10 +-
 include/net/vxlan.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index b04e103..96aa7e6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1034,11 +1034,11 @@ static bool vxlan_group_used(struct vxlan_net *vn, 
struct vxlan_dev *dev)
/* The vxlan_sock is only used by dev, leaving group has
 * no effect on other vxlan devices.
 */
-   if (family == AF_INET && sock4 && atomic_read(&sock4->refcnt) == 1)
+   if (family == AF_INET && sock4 && refcount_read(&sock4->refcnt) == 1)
return false;
 #if IS_ENABLED(CONFIG_IPV6)
sock6 = rtnl_dereference(dev->vn6_sock);
-   if (family == AF_INET6 && sock6 && atomic_read(&sock6->refcnt) == 1)
+   if (family == AF_INET6 && sock6 && refcount_read(&sock6->refcnt) == 1)
return false;
 #endif
 
@@ -1075,7 +1075,7 @@ static bool __vxlan_sock_release_prep(struct vxlan_sock 
*vs)
 
if (!vs)
return false;
-   if (!atomic_dec_and_test(&vs->refcnt))
+   if (!refcount_dec_and_test(&vs->refcnt))
return false;
 
vn = net_generic(sock_net(vs->sock->sk), vxlan_net_id);
@@ -2825,7 +2825,7 @@ static struct vxlan_sock *vxlan_socket_create(struct net 
*net, bool ipv6,
}
 
vs->sock = sock;
-   atomic_set(&vs->refcnt, 1);
+   refcount_set(&vs->refcnt, 1);
vs->flags = (flags & VXLAN_F_RCV_FLAGS);
 
spin_lock(&vn->sock_lock);
@@ -2860,7 +2860,7 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool 
ipv6)
spin_lock(&vn->sock_lock);
vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
 vxlan->cfg.dst_port, vxlan->cfg.flags);
-   if (vs && !atomic_add_unless(&vs->refcnt, 1, 0)) {
+   if (vs && !refcount_inc_not_zero(&vs->refcnt)) {
spin_unlock(&vn->sock_lock);
return -EBUSY;
}
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 326e849..3f430e3 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -183,7 +183,7 @@ struct vxlan_sock {
struct hlist_node hlist;
struct socket*sock;
struct hlist_head vni_list[VNI_HASH_SIZE];
-   atomic_t  refcnt;
+   refcount_trefcnt;
u32   flags;
 };
 
-- 
2.7.4

[PATCH 08/36] net, atm: convert in_cache_entry.use from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/atm/mpoa_caches.c | 12 ++--
 net/atm/mpoa_caches.h |  3 ++-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index a89fdeb..05e89e9 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -40,7 +40,7 @@ static in_cache_entry *in_cache_get(__be32 dst_ip,
entry = client->in_cache;
while (entry != NULL) {
if (entry->ctrl_info.in_dst_ip == dst_ip) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_bh(&client->ingress_lock);
return entry;
}
@@ -61,7 +61,7 @@ static in_cache_entry *in_cache_get_with_mask(__be32 dst_ip,
entry = client->in_cache;
while (entry != NULL) {
if ((entry->ctrl_info.in_dst_ip & mask) == (dst_ip & mask)) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_bh(&client->ingress_lock);
return entry;
}
@@ -82,7 +82,7 @@ static in_cache_entry *in_cache_get_by_vcc(struct atm_vcc 
*vcc,
entry = client->in_cache;
while (entry != NULL) {
if (entry->shortcut == vcc) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_bh(&client->ingress_lock);
return entry;
}
@@ -105,7 +105,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
 
dprintk("adding an ingress entry, ip = %pI4\n", &dst_ip);
 
-   atomic_set(&entry->use, 1);
+   refcount_set(&entry->use, 1);
dprintk("new_in_cache_entry: about to lock\n");
write_lock_bh(&client->ingress_lock);
entry->next = client->in_cache;
@@ -121,7 +121,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
entry->count = 1;
entry->entry_state = INGRESS_INVALID;
entry->ctrl_info.holding_time = HOLDING_TIME_DEFAULT;
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
 
write_unlock_bh(&client->ingress_lock);
dprintk("new_in_cache_entry: unlocked\n");
@@ -178,7 +178,7 @@ static int cache_hit(in_cache_entry *entry, struct 
mpoa_client *mpc)
 
 static void in_cache_put(in_cache_entry *entry)
 {
-   if (atomic_dec_and_test(&entry->use)) {
+   if (refcount_dec_and_test(&entry->use)) {
memset(entry, 0, sizeof(in_cache_entry));
kfree(entry);
}
diff --git a/net/atm/mpoa_caches.h b/net/atm/mpoa_caches.h
index 8e5f78c..38a4e7e 100644
--- a/net/atm/mpoa_caches.h
+++ b/net/atm/mpoa_caches.h
@@ -6,6 +6,7 @@
 #include 
 #include 
 #include 
+#include 
 
 struct mpoa_client;
 
@@ -25,7 +26,7 @@ typedef struct in_cache_entry {
struct   atm_vcc *shortcut;
uint8_t  MPS_ctrl_ATM_addr[ATM_ESA_LEN];
struct   in_ctrl_info ctrl_info;
-   atomic_t use;
+   refcount_t use;
 } in_cache_entry;
 
 struct in_cache_ops{
-- 
2.7.4

[PATCH 06/36] net, atm: convert atm_dev.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/linux/atmdev.h | 7 ---
 net/atm/proc.c | 2 +-
 net/atm/resources.c| 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
index 4d97a89..0ec9bdb 100644
--- a/include/linux/atmdev.h
+++ b/include/linux/atmdev.h
@@ -11,6 +11,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 #ifdef CONFIG_PROC_FS
@@ -158,7 +159,7 @@ struct atm_dev {
struct k_atm_dev_stats stats;   /* statistics */
charsignal; /* signal status (ATM_PHY_SIG_*) */
int link_rate;  /* link rate (default: OC3) */
-   atomic_trefcnt; /* reference count */
+   refcount_t  refcnt; /* reference count */
spinlock_t  lock;   /* protect internal members */
 #ifdef CONFIG_PROC_FS
struct proc_dir_entry *proc_entry; /* proc entry */
@@ -261,13 +262,13 @@ static inline int atm_may_send(struct atm_vcc 
*vcc,unsigned int size)
 
 static inline void atm_dev_hold(struct atm_dev *dev)
 {
-   atomic_inc(&dev->refcnt);
+   refcount_inc(&dev->refcnt);
 }
 
 
 static inline void atm_dev_put(struct atm_dev *dev)
 {
-   if (atomic_dec_and_test(&dev->refcnt)) {
+   if (refcount_dec_and_test(&dev->refcnt)) {
BUG_ON(!test_bit(ATM_DF_REMOVED, &dev->flags));
if (dev->ops->dev_close)
dev->ops->dev_close(dev);
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 27c9c01..4caca2a 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -61,7 +61,7 @@ static void atm_dev_info(struct seq_file *seq, const struct 
atm_dev *dev)
add_stats(seq, "0", &dev->stats.aal0);
seq_puts(seq, "  ");
add_stats(seq, "5", &dev->stats.aal5);
-   seq_printf(seq, "\t[%d]", atomic_read(&dev->refcnt));
+   seq_printf(seq, "\t[%d]", refcount_read(&dev->refcnt));
seq_putc(seq, '\n');
 }
 
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 0447d5d..9182447 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -109,7 +109,7 @@ struct atm_dev *atm_dev_register(const char *type, struct 
device *parent,
else
memset(&dev->flags, 0, sizeof(dev->flags));
memset(&dev->stats, 0, sizeof(dev->stats));
-   atomic_set(&dev->refcnt, 1);
+   refcount_set(&dev->refcnt, 1);
 
if (atm_proc_dev_register(dev) < 0) {
pr_err("atm_proc_dev_register failed for dev %s\n", type);
-- 
2.7.4

[PATCH 13/36] net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/lapb.h| 3 ++-
 net/lapb/lapb_iface.c | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/net/lapb.h b/include/net/lapb.h
index 9510f87..85e7737 100644
--- a/include/net/lapb.h
+++ b/include/net/lapb.h
@@ -1,6 +1,7 @@
 #ifndef _LAPB_H
 #define _LAPB_H 
 #include 
+#include 
 
 #defineLAPB_HEADER_LEN 20  /* LAPB over Ethernet + a bit 
more */
 
@@ -101,7 +102,7 @@ struct lapb_cb {
struct lapb_frame   frmr_data;
unsigned char   frmr_type;
 
-   atomic_trefcnt;
+   refcount_t  refcnt;
 };
 
 /* lapb_iface.c */
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index b50b64a..e15314e 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -54,12 +54,12 @@ static void lapb_free_cb(struct lapb_cb *lapb)
 
 static __inline__ void lapb_hold(struct lapb_cb *lapb)
 {
-   atomic_inc(&lapb->refcnt);
+   refcount_inc(&lapb->refcnt);
 }
 
 static __inline__ void lapb_put(struct lapb_cb *lapb)
 {
-   if (atomic_dec_and_test(&lapb->refcnt))
+   if (refcount_dec_and_test(&lapb->refcnt))
lapb_free_cb(lapb);
 }
 
@@ -136,7 +136,7 @@ static struct lapb_cb *lapb_create_cb(void)
lapb->mode= LAPB_DEFAULT_MODE;
lapb->window  = LAPB_DEFAULT_WINDOW;
lapb->state   = LAPB_STATE_0;
-   atomic_set(&lapb->refcnt, 1);
+   refcount_set(&lapb->refcnt, 1);
 out:
return lapb;
 }
-- 
2.7.4

[PATCH 14/36] net, ipx: convert ipx_interface.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/ipx.h  | 7 ---
 net/ipx/af_ipx.c   | 6 +++---
 net/ipx/ipx_proc.c | 2 +-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/include/net/ipx.h b/include/net/ipx.h
index e5cff68..2de1281 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -14,6 +14,7 @@
 #include 
 #include 
 #include 
+#include 
 
 struct ipx_address {
__be32  net;
@@ -54,7 +55,7 @@ struct ipx_interface {
/* IPX address */
__be32  if_netnum;
unsigned char   if_node[IPX_NODE_LEN];
-   atomic_trefcnt;
+   refcount_t  refcnt;
 
/* physical device info */
struct net_device   *if_dev;
@@ -139,7 +140,7 @@ const char *ipx_device_name(struct ipx_interface *intrfc);
 
 static __inline__ void ipxitf_hold(struct ipx_interface *intrfc)
 {
-   atomic_inc(&intrfc->refcnt);
+   refcount_inc(&intrfc->refcnt);
 }
 
 void ipxitf_down(struct ipx_interface *intrfc);
@@ -157,7 +158,7 @@ int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
 
 static __inline__ void ipxitf_put(struct ipx_interface *intrfc)
 {
-   if (atomic_dec_and_test(&intrfc->refcnt))
+   if (refcount_dec_and_test(&intrfc->refcnt))
ipxitf_down(intrfc);
 }
 
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index fa31ef2..ac598ec 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -308,7 +308,7 @@ void ipxitf_down(struct ipx_interface *intrfc)
 
 static void __ipxitf_put(struct ipx_interface *intrfc)
 {
-   if (atomic_dec_and_test(&intrfc->refcnt))
+   if (refcount_dec_and_test(&intrfc->refcnt))
__ipxitf_down(intrfc);
 }
 
@@ -876,7 +876,7 @@ static struct ipx_interface *ipxitf_alloc(struct net_device 
*dev, __be32 netnum,
intrfc->if_ipx_offset   = ipx_offset;
intrfc->if_sknum= IPX_MIN_EPHEMERAL_SOCKET;
INIT_HLIST_HEAD(&intrfc->if_sklist);
-   atomic_set(&intrfc->refcnt, 1);
+   refcount_set(&intrfc->refcnt, 1);
spin_lock_init(&intrfc->if_sklist_lock);
}
 
@@ -1105,7 +1105,7 @@ static struct ipx_interface *ipxitf_auto_create(struct 
net_device *dev,
memcpy((char *)&(intrfc->if_node[IPX_NODE_LEN-dev->addr_len]),
dev->dev_addr, dev->addr_len);
spin_lock_init(&intrfc->if_sklist_lock);
-   atomic_set(&intrfc->refcnt, 1);
+   refcount_set(&intrfc->refcnt, 1);
ipxitf_insert(intrfc);
dev_hold(dev);
}
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index c1d247e..7d75e4c 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -53,7 +53,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void 
*v)
seq_printf(seq, "%-11s", ipx_device_name(i));
seq_printf(seq, "%-9s", ipx_frame_name(i->if_dlink_type));
 #ifdef IPX_REFCNT_DEBUG
-   seq_printf(seq, "%6d", atomic_read(&i->refcnt));
+   seq_printf(seq, "%6d", refcount_read(&i->refcnt));
 #endif
seq_puts(seq, "\n");
 out:
-- 
2.7.4

[PATCH 15/36] net, ipx: convert ipx_route.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/ipx.h   | 6 +++---
 net/ipx/ipx_route.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/ipx.h b/include/net/ipx.h
index 2de1281..af32b97 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -81,7 +81,7 @@ struct ipx_route {
unsigned char   ir_routed;
unsigned char   ir_router_node[IPX_NODE_LEN];
struct list_headnode; /* node in ipx_routes list */
-   atomic_trefcnt;
+   refcount_t  refcnt;
 };
 
 struct ipx_cb {
@@ -164,12 +164,12 @@ static __inline__ void ipxitf_put(struct ipx_interface 
*intrfc)
 
 static __inline__ void ipxrtr_hold(struct ipx_route *rt)
 {
-   atomic_inc(&rt->refcnt);
+   refcount_inc(&rt->refcnt);
 }
 
 static __inline__ void ipxrtr_put(struct ipx_route *rt)
 {
-   if (atomic_dec_and_test(&rt->refcnt))
+   if (refcount_dec_and_test(&rt->refcnt))
kfree(rt);
 }
 #endif /* _NET_INET_IPX_H_ */
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index 3e2a32a..b5d9144 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -59,7 +59,7 @@ int ipxrtr_add_route(__be32 network, struct ipx_interface 
*intrfc,
if (!rt)
goto out;
 
-   atomic_set(&rt->refcnt, 1);
+   refcount_set(&rt->refcnt, 1);
ipxrtr_hold(rt);
write_lock_bh(&ipx_routes_lock);
list_add(&rt->node, &ipx_routes);
-- 
2.7.4

[PATCH 09/36] net, atm: convert eg_cache_entry.use from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/atm/mpoa_caches.c | 14 +++---
 net/atm/mpoa_caches.h |  2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index 05e89e9..4ccaa16 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -339,7 +339,7 @@ static eg_cache_entry *eg_cache_get_by_cache_id(__be32 
cache_id,
entry = mpc->eg_cache;
while (entry != NULL) {
if (entry->ctrl_info.cache_id == cache_id) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_irq(&mpc->egress_lock);
return entry;
}
@@ -360,7 +360,7 @@ static eg_cache_entry *eg_cache_get_by_tag(__be32 tag, 
struct mpoa_client *mpc)
entry = mpc->eg_cache;
while (entry != NULL) {
if (entry->ctrl_info.tag == tag) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_irqrestore(&mpc->egress_lock, flags);
return entry;
}
@@ -382,7 +382,7 @@ static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc 
*vcc,
entry = mpc->eg_cache;
while (entry != NULL) {
if (entry->shortcut == vcc) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_irqrestore(&mpc->egress_lock, flags);
return entry;
}
@@ -402,7 +402,7 @@ static eg_cache_entry *eg_cache_get_by_src_ip(__be32 ipaddr,
entry = mpc->eg_cache;
while (entry != NULL) {
if (entry->latest_ip_addr == ipaddr) {
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
read_unlock_irq(&mpc->egress_lock);
return entry;
}
@@ -415,7 +415,7 @@ static eg_cache_entry *eg_cache_get_by_src_ip(__be32 ipaddr,
 
 static void eg_cache_put(eg_cache_entry *entry)
 {
-   if (atomic_dec_and_test(&entry->use)) {
+   if (refcount_dec_and_test(&entry->use)) {
memset(entry, 0, sizeof(eg_cache_entry));
kfree(entry);
}
@@ -468,7 +468,7 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message 
*msg,
dprintk("adding an egress entry, ip = %pI4, this should be our IP\n",
&msg->content.eg_info.eg_dst_ip);
 
-   atomic_set(&entry->use, 1);
+   refcount_set(&entry->use, 1);
dprintk("new_eg_cache_entry: about to lock\n");
write_lock_irq(&client->egress_lock);
entry->next = client->eg_cache;
@@ -484,7 +484,7 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message 
*msg,
dprintk("new_eg_cache_entry cache_id %u\n",
ntohl(entry->ctrl_info.cache_id));
dprintk("mps_ip = %pI4\n", &entry->ctrl_info.mps_ip);
-   atomic_inc(&entry->use);
+   refcount_inc(&entry->use);
 
write_unlock_irq(&client->egress_lock);
dprintk("new_eg_cache_entry: unlocked\n");
diff --git a/net/atm/mpoa_caches.h b/net/atm/mpoa_caches.h
index 38a4e7e..30fe348 100644
--- a/net/atm/mpoa_caches.h
+++ b/net/atm/mpoa_caches.h
@@ -59,7 +59,7 @@ typedef struct eg_cache_entry{
uint16_t entry_state;
__be32 latest_ip_addr;/* The src IP address of the last 
packet */
struct eg_ctrl_info  ctrl_info;
-   atomic_t use;
+   refcount_t use;
 } eg_cache_entry;
 
 struct eg_cache_ops{
-- 
2.7.4

[PATCH 12/36] net, sched: convert Qdisc.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/sch_generic.h | 3 ++-
 net/sched/sch_api.c   | 8 
 net/sched/sch_generic.c   | 8 
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 3688501..1c123e2 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -9,6 +9,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 
@@ -95,7 +96,7 @@ struct Qdisc {
struct sk_buff  *skb_bad_txq;
struct rcu_head rcu_head;
int padded;
-   atomic_trefcnt;
+   refcount_t  refcnt;
 
spinlock_t  busylock cacheline_aligned_in_smp;
 };
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 43b94c7..bd24a55 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -839,7 +839,7 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc 
*parent,
 
old = dev_graft_qdisc(dev_queue, new);
if (new && i > 0)
-   atomic_inc(&new->refcnt);
+   refcount_inc(&new->refcnt);
 
if (!ingress)
qdisc_destroy(old);
@@ -850,7 +850,7 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc 
*parent,
notify_and_destroy(net, skb, n, classid,
   dev->qdisc, new);
if (new && !new->ops->attach)
-   atomic_inc(&new->refcnt);
+   refcount_inc(&new->refcnt);
dev->qdisc = new ? : &noop_qdisc;
 
if (new && new->ops->attach)
@@ -1259,7 +1259,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct 
nlmsghdr *n,
if (q == p ||
(p && check_loop(q, p, 0)))
return -ELOOP;
-   atomic_inc(&q->refcnt);
+   refcount_inc(&q->refcnt);
goto graft;
} else {
if (!q)
@@ -1374,7 +1374,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct 
Qdisc *q, u32 clid,
tcm->tcm_ifindex = qdisc_dev(q)->ifindex;
tcm->tcm_parent = clid;
tcm->tcm_handle = q->handle;
-   tcm->tcm_info = atomic_read(&q->refcnt);
+   tcm->tcm_info = refcount_read(&q->refcnt);
if (nla_put_string(skb, TCA_KIND, q->ops->id))
goto nla_put_failure;
if (q->ops->dump && q->ops->dump(q, skb) < 0)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 52a2c55..57ba406 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -633,7 +633,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
sch->dequeue = ops->dequeue;
sch->dev_queue = dev_queue;
dev_hold(dev);
-   atomic_set(&sch->refcnt, 1);
+   refcount_set(&sch->refcnt, 1);
 
return sch;
 errout:
@@ -701,7 +701,7 @@ void qdisc_destroy(struct Qdisc *qdisc)
const struct Qdisc_ops  *ops = qdisc->ops;
 
if (qdisc->flags & TCQ_F_BUILTIN ||
-   !atomic_dec_and_test(&qdisc->refcnt))
+   !refcount_dec_and_test(&qdisc->refcnt))
return;
 
 #ifdef CONFIG_NET_SCHED
@@ -739,7 +739,7 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue 
*dev_queue,
spin_lock_bh(root_lock);
 
/* Prune old scheduler */
-   if (oqdisc && atomic_read(&oqdisc->refcnt) <= 1)
+   if (oqdisc && refcount_read(&oqdisc->refcnt) <= 1)
qdisc_reset(oqdisc);
 
/* ... and graft new one */
@@ -785,7 +785,7 @@ static void attach_default_qdiscs(struct net_device *dev)
dev->priv_flags & IFF_NO_QUEUE) {
netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL);
dev->qdisc = txq->qdisc_sleeping;
-   atomic_inc(&dev->qdisc->refcnt);
+   refcount_inc(&dev->qdisc->refcnt);
} else {
qdisc = qdisc_create_dflt(txq, &mq_qdisc_ops, TC_H_ROOT);
if (qdisc) {
-- 
2.7.4

[PATCH 18/36] net, sunrpc: convert gss_cl_ctx.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/linux/sunrpc/auth_gss.h | 3 ++-
 net/sunrpc/auth_gss/auth_gss.c  | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/linux/sunrpc/auth_gss.h b/include/linux/sunrpc/auth_gss.h
index 36eebc4..cebdf87 100644
--- a/include/linux/sunrpc/auth_gss.h
+++ b/include/linux/sunrpc/auth_gss.h
@@ -13,6 +13,7 @@
 #define _LINUX_SUNRPC_AUTH_GSS_H
 
 #ifdef __KERNEL__
+#include 
 #include 
 #include 
 #include 
@@ -65,7 +66,7 @@ struct rpc_gss_init_res {
  * the wire when communicating with a server. */
 
 struct gss_cl_ctx {
-   atomic_tcount;
+   refcount_t  count;
enum rpc_gss_proc   gc_proc;
u32 gc_seq;
spinlock_t  gc_seq_lock;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 4f16953..72f129c 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -117,14 +117,14 @@ static const struct rpc_pipe_ops gss_upcall_ops_v1;
 static inline struct gss_cl_ctx *
 gss_get_ctx(struct gss_cl_ctx *ctx)
 {
-   atomic_inc(&ctx->count);
+   refcount_inc(&ctx->count);
return ctx;
 }
 
 static inline void
 gss_put_ctx(struct gss_cl_ctx *ctx)
 {
-   if (atomic_dec_and_test(&ctx->count))
+   if (refcount_dec_and_test(&ctx->count))
gss_free_ctx(ctx);
 }
 
@@ -200,7 +200,7 @@ gss_alloc_context(void)
ctx->gc_proc = RPC_GSS_PROC_DATA;
ctx->gc_seq = 1;/* NetApp 6.4R1 doesn't accept seq. no. 
0 */
spin_lock_init(&ctx->gc_seq_lock);
-   atomic_set(&ctx->count,1);
+   refcount_set(&ctx->count,1);
}
return ctx;
 }
-- 
2.7.4

[PATCH 17/36] net, netrom: convert nr_node.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/netrom.h  | 6 +++---
 net/netrom/nr_route.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/netrom.h b/include/net/netrom.h
index cecb4fd..443a4ff 100644
--- a/include/net/netrom.h
+++ b/include/net/netrom.h
@@ -110,7 +110,7 @@ struct nr_node {
unsigned char   which;
unsigned char   count;
struct nr_route routes[3];
-   atomic_trefcount;
+   refcount_t  refcount;
spinlock_t  node_lock;
 };
 
@@ -119,11 +119,11 @@ struct nr_node {
  */
 
 #define nr_node_hold(__nr_node) \
-   atomic_inc(&((__nr_node)->refcount))
+   refcount_inc(&((__nr_node)->refcount))
 
 static __inline__ void nr_node_put(struct nr_node *nr_node)
 {
-   if (atomic_dec_and_test(&nr_node->refcount)) {
+   if (refcount_dec_and_test(&nr_node->refcount)) {
kfree(nr_node);
}
 }
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 6b72970..0c59354 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -184,7 +184,7 @@ static int __must_check nr_add_node(ax25_address *nr, const 
char *mnemonic,
 
nr_node->which = 0;
nr_node->count = 1;
-   atomic_set(&nr_node->refcount, 1);
+   refcount_set(&nr_node->refcount, 1);
spin_lock_init(&nr_node->node_lock);
 
nr_node->routes[0].quality   = quality;
-- 
2.7.4

[PATCH 19/36] net, sunrpc: convert gss_upcall_msg.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/sunrpc/auth_gss/auth_gss.c | 22 +++---
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 72f129c..9463af4 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -287,7 +287,7 @@ gss_fill_context(const void *p, const void *end, struct 
gss_cl_ctx *ctx, struct
 #define UPCALL_BUF_LEN 128
 
 struct gss_upcall_msg {
-   atomic_t count;
+   refcount_t count;
kuid_t  uid;
struct rpc_pipe_msg msg;
struct list_head list;
@@ -328,7 +328,7 @@ static void
 gss_release_msg(struct gss_upcall_msg *gss_msg)
 {
struct net *net = gss_msg->auth->net;
-   if (!atomic_dec_and_test(&gss_msg->count))
+   if (!refcount_dec_and_test(&gss_msg->count))
return;
put_pipe_version(net);
BUG_ON(!list_empty(&gss_msg->list));
@@ -348,7 +348,7 @@ __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const 
struct gss_auth *auth
continue;
if (auth && pos->auth->service != auth->service)
continue;
-   atomic_inc(&pos->count);
+   refcount_inc(&pos->count);
dprintk("RPC:   %s found msg %p\n", __func__, pos);
return pos;
}
@@ -369,7 +369,7 @@ gss_add_msg(struct gss_upcall_msg *gss_msg)
spin_lock(&pipe->lock);
old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
if (old == NULL) {
-   atomic_inc(&gss_msg->count);
+   refcount_inc(&gss_msg->count);
list_add(&gss_msg->list, &pipe->in_downcall);
} else
gss_msg = old;
@@ -383,7 +383,7 @@ __gss_unhash_msg(struct gss_upcall_msg *gss_msg)
list_del_init(&gss_msg->list);
rpc_wake_up_status(&gss_msg->rpc_waitqueue, gss_msg->msg.errno);
wake_up_all(&gss_msg->waitqueue);
-   atomic_dec(&gss_msg->count);
+   refcount_dec(&gss_msg->count);
 }
 
 static void
@@ -506,7 +506,7 @@ gss_alloc_msg(struct gss_auth *gss_auth,
INIT_LIST_HEAD(&gss_msg->list);
rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
init_waitqueue_head(&gss_msg->waitqueue);
-   atomic_set(&gss_msg->count, 1);
+   refcount_set(&gss_msg->count, 1);
gss_msg->uid = uid;
gss_msg->auth = gss_auth;
switch (vers) {
@@ -542,11 +542,11 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct 
rpc_cred *cred)
gss_msg = gss_add_msg(gss_new);
if (gss_msg == gss_new) {
int res;
-   atomic_inc(&gss_msg->count);
+   refcount_inc(&gss_msg->count);
res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
if (res) {
gss_unhash_msg(gss_new);
-   atomic_dec(&gss_msg->count);
+   refcount_dec(&gss_msg->count);
gss_release_msg(gss_new);
gss_msg = ERR_PTR(res);
}
@@ -595,7 +595,7 @@ gss_refresh_upcall(struct rpc_task *task)
task->tk_timeout = 0;
gss_cred->gc_upcall = gss_msg;
/* gss_upcall_callback will release the reference to 
gss_upcall_msg */
-   atomic_inc(&gss_msg->count);
+   refcount_inc(&gss_msg->count);
rpc_sleep_on(&gss_msg->rpc_waitqueue, task, 
gss_upcall_callback);
} else {
gss_handle_downcall_result(gss_cred, gss_msg);
@@ -815,7 +815,7 @@ gss_pipe_release(struct inode *inode)
if (!list_empty(&gss_msg->msg.list))
continue;
gss_msg->msg.errno = -EPIPE;
-   atomic_inc(&gss_msg->count);
+   refcount_inc(&gss_msg->count);
__gss_unhash_msg(gss_msg);
spin_unlock(&pipe->lock);
gss_release_msg(gss_msg);
@@ -834,7 +834,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
if (msg->errno < 0) {
dprintk("RPC:   %s releasing msg %p\n",
__func__, gss_msg);
-   atomic_inc(&gss_msg->count);
+   refcount_inc(&gss_msg->count);
gss_unhash_msg(gss_msg);
if (msg->errno == -ETIMEDOUT)
warn_gssd();
-- 
2.7.4

[PATCH 21/36] net, rds: convert rds_incoming.i_refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/rds/rds.h  |  3 ++-
 net/rds/recv.c | 12 ++--
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/net/rds/rds.h b/net/rds/rds.h
index 4a25db7..35ceaa2 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -8,6 +8,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include "info.h"
 
@@ -261,7 +262,7 @@ struct rds_ext_header_rdma_dest {
 #defineRDS_MSG_RX_CMSG 3
 
 struct rds_incoming {
-   atomic_ti_refcount;
+   refcount_t  i_refcount;
struct list_headi_item;
struct rds_connection   *i_conn;
struct rds_conn_path*i_conn_path;
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 373a6aa1..b25bcfe 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -45,7 +45,7 @@ void rds_inc_init(struct rds_incoming *inc, struct 
rds_connection *conn,
 {
int i;
 
-   atomic_set(&inc->i_refcount, 1);
+   refcount_set(&inc->i_refcount, 1);
INIT_LIST_HEAD(&inc->i_item);
inc->i_conn = conn;
inc->i_saddr = saddr;
@@ -61,7 +61,7 @@ EXPORT_SYMBOL_GPL(rds_inc_init);
 void rds_inc_path_init(struct rds_incoming *inc, struct rds_conn_path *cp,
   __be32 saddr)
 {
-   atomic_set(&inc->i_refcount, 1);
+   refcount_set(&inc->i_refcount, 1);
INIT_LIST_HEAD(&inc->i_item);
inc->i_conn = cp->cp_conn;
inc->i_conn_path = cp;
@@ -74,14 +74,14 @@ EXPORT_SYMBOL_GPL(rds_inc_path_init);
 
 static void rds_inc_addref(struct rds_incoming *inc)
 {
-   rdsdebug("addref inc %p ref %d\n", inc, atomic_read(&inc->i_refcount));
-   atomic_inc(&inc->i_refcount);
+   rdsdebug("addref inc %p ref %d\n", inc, 
refcount_read(&inc->i_refcount));
+   refcount_inc(&inc->i_refcount);
 }
 
 void rds_inc_put(struct rds_incoming *inc)
 {
-   rdsdebug("put inc %p ref %d\n", inc, atomic_read(&inc->i_refcount));
-   if (atomic_dec_and_test(&inc->i_refcount)) {
+   rdsdebug("put inc %p ref %d\n", inc, refcount_read(&inc->i_refcount));
+   if (refcount_dec_and_test(&inc->i_refcount)) {
BUG_ON(!list_empty(&inc->i_item));
 
inc->i_conn->c_trans->inc_free(inc);
-- 
2.7.4

[PATCH 24/36] net, x25: convert x25_route.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/x25.h   | 7 ---
 net/x25/x25_route.c | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/net/x25.h b/include/net/x25.h
index 6d30a01..1ac1400 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -11,6 +11,7 @@
 #define _X25_H 
 #include 
 #include 
+#include 
 #include 
 
 #defineX25_ADDR_LEN16
@@ -129,7 +130,7 @@ struct x25_route {
struct x25_address  address;
unsigned intsigdigits;
struct net_device   *dev;
-   atomic_trefcnt;
+   refcount_t  refcnt;
 };
 
 struct x25_neigh {
@@ -265,12 +266,12 @@ void x25_route_free(void);
 
 static __inline__ void x25_route_hold(struct x25_route *rt)
 {
-   atomic_inc(&rt->refcnt);
+   refcount_inc(&rt->refcnt);
 }
 
 static __inline__ void x25_route_put(struct x25_route *rt)
 {
-   if (atomic_dec_and_test(&rt->refcnt))
+   if (refcount_dec_and_test(&rt->refcnt))
kfree(rt);
 }
 
diff --git a/net/x25/x25_route.c b/net/x25/x25_route.c
index 277c8d2..b85b889 100644
--- a/net/x25/x25_route.c
+++ b/net/x25/x25_route.c
@@ -55,7 +55,7 @@ static int x25_add_route(struct x25_address *address, 
unsigned int sigdigits,
 
rt->sigdigits = sigdigits;
rt->dev   = dev;
-   atomic_set(&rt->refcnt, 1);
+   refcount_set(&rt->refcnt, 1);
 
list_add(&rt->node, &x25_route_list);
rc = 0;
-- 
2.7.4

[PATCH 27/36] net, xfrm: convert xfrm_policy.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/xfrm.h | 6 +++---
 net/key/af_key.c   | 2 +-
 net/xfrm/xfrm_policy.c | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index f5272a2..e1bd1de 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -560,7 +560,7 @@ struct xfrm_policy {
 
/* This lock only affects elements except for entry. */
rwlock_tlock;
-   atomic_trefcnt;
+   refcount_t  refcnt;
struct timer_list   timer;
 
struct flow_cache_object flo;
@@ -816,14 +816,14 @@ static inline void xfrm_audit_state_icvfail(struct 
xfrm_state *x,
 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 {
if (likely(policy != NULL))
-   atomic_inc(&policy->refcnt);
+   refcount_inc(&policy->refcnt);
 }
 
 void xfrm_policy_destroy(struct xfrm_policy *policy);
 
 static inline void xfrm_pol_put(struct xfrm_policy *policy)
 {
-   if (atomic_dec_and_test(&policy->refcnt))
+   if (refcount_dec_and_test(&policy->refcnt))
xfrm_policy_destroy(policy);
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index edcf1d0..ca9d3ae 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2177,7 +2177,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, 
const struct xfrm_policy *
}
 
hdr->sadb_msg_len = size / sizeof(uint64_t);
-   hdr->sadb_msg_reserved = atomic_read(&xp->refcnt);
+   hdr->sadb_msg_reserved = refcount_read(&xp->refcnt);
 
return 0;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 4706df6..ff61d85 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -62,7 +62,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct 
xfrm_policy *pol,
 
 static inline bool xfrm_pol_hold_rcu(struct xfrm_policy *policy)
 {
-   return atomic_inc_not_zero(&policy->refcnt);
+   return refcount_inc_not_zero(&policy->refcnt);
 }
 
 static inline bool
@@ -292,7 +292,7 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, 
gfp_t gfp)
INIT_HLIST_NODE(&policy->bydst);
INIT_HLIST_NODE(&policy->byidx);
rwlock_init(&policy->lock);
-   atomic_set(&policy->refcnt, 1);
+   refcount_set(&policy->refcnt, 1);
skb_queue_head_init(&policy->polq.hold_queue);
setup_timer(&policy->timer, xfrm_policy_timer,
(unsigned long)policy);
-- 
2.7.4

[PATCH 30/36] net, sctp: convert sctp_datamsg.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/sctp/structs.h | 2 +-
 net/sctp/chunk.c   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 07c11fe..4d7c855 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -496,7 +496,7 @@ struct sctp_datamsg {
/* Chunks waiting to be submitted to lower layer. */
struct list_head chunks;
/* Reference counting. */
-   atomic_t refcnt;
+   refcount_t refcnt;
/* When is this message no longer interesting to the peer? */
unsigned long expires_at;
/* Did the messenge fail to send? */
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 81466f6..1323d41 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -49,7 +49,7 @@
 /* Initialize datamsg from memory. */
 static void sctp_datamsg_init(struct sctp_datamsg *msg)
 {
-   atomic_set(&msg->refcnt, 1);
+   refcount_set(&msg->refcnt, 1);
msg->send_failed = 0;
msg->send_error = 0;
msg->can_delay = 1;
@@ -136,13 +136,13 @@ static void sctp_datamsg_destroy(struct sctp_datamsg *msg)
 /* Hold a reference. */
 static void sctp_datamsg_hold(struct sctp_datamsg *msg)
 {
-   atomic_inc(&msg->refcnt);
+   refcount_inc(&msg->refcnt);
 }
 
 /* Release a reference. */
 void sctp_datamsg_put(struct sctp_datamsg *msg)
 {
-   if (atomic_dec_and_test(&msg->refcnt))
+   if (refcount_dec_and_test(&msg->refcnt))
sctp_datamsg_destroy(msg);
 }
 
-- 
2.7.4

[PATCH 23/36] net, rds: convert rds_message.m_refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/rds/message.c | 12 ++--
 net/rds/rds.h |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/rds/message.c b/net/rds/message.c
index 49bfb51..4318cc9 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -48,8 +48,8 @@ static unsigned int   rds_exthdr_size[__RDS_EXTHDR_MAX] = {
 
 void rds_message_addref(struct rds_message *rm)
 {
-   rdsdebug("addref rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-   atomic_inc(&rm->m_refcount);
+   rdsdebug("addref rm %p ref %d\n", rm, refcount_read(&rm->m_refcount));
+   refcount_inc(&rm->m_refcount);
 }
 EXPORT_SYMBOL_GPL(rds_message_addref);
 
@@ -83,9 +83,9 @@ static void rds_message_purge(struct rds_message *rm)
 
 void rds_message_put(struct rds_message *rm)
 {
-   rdsdebug("put rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-   WARN(!atomic_read(&rm->m_refcount), "danger refcount zero on %p\n", rm);
-   if (atomic_dec_and_test(&rm->m_refcount)) {
+   rdsdebug("put rm %p ref %d\n", rm, refcount_read(&rm->m_refcount));
+   WARN(!refcount_read(&rm->m_refcount), "danger refcount zero on %p\n", 
rm);
+   if (refcount_dec_and_test(&rm->m_refcount)) {
BUG_ON(!list_empty(&rm->m_sock_item));
BUG_ON(!list_empty(&rm->m_conn_item));
rds_message_purge(rm);
@@ -206,7 +206,7 @@ struct rds_message *rds_message_alloc(unsigned int 
extra_len, gfp_t gfp)
rm->m_used_sgs = 0;
rm->m_total_sgs = extra_len / sizeof(struct scatterlist);
 
-   atomic_set(&rm->m_refcount, 1);
+   refcount_set(&rm->m_refcount, 1);
INIT_LIST_HEAD(&rm->m_sock_item);
INIT_LIST_HEAD(&rm->m_conn_item);
spin_lock_init(&rm->m_rs_lock);
diff --git a/net/rds/rds.h b/net/rds/rds.h
index ea72d6e..516bcc8 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -356,7 +356,7 @@ static inline u32 rds_rdma_cookie_offset(rds_rdma_cookie_t 
cookie)
 #define RDS_MSG_FLUSH  8
 
 struct rds_message {
-   atomic_tm_refcount;
+   refcount_t  m_refcount;
struct list_headm_sock_item;
struct list_headm_conn_item;
struct rds_incoming m_inc;
-- 
2.7.4

[PATCH 33/36] net, sctp: convert sctp_ep_common.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/sctp/structs.h | 2 +-
 net/sctp/associola.c   | 6 +++---
 net/sctp/endpointola.c | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 6a0d372..5ab29af 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1174,7 +1174,7 @@ struct sctp_ep_common {
 *   refcnt   - Reference count access to this object.
 *   dead - Do not attempt to use this object.
 */
-   atomic_trefcnt;
+   refcount_trefcnt;
booldead;
 
/* What socket does this endpoint belong to?  */
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index fa4f530..40ec836 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -88,7 +88,7 @@ static struct sctp_association *sctp_association_init(struct 
sctp_association *a
asoc->base.type = SCTP_EP_TYPE_ASSOCIATION;
 
/* Initialize the object handling fields.  */
-   atomic_set(&asoc->base.refcnt, 1);
+   refcount_set(&asoc->base.refcnt, 1);
 
/* Initialize the bind addr area.  */
sctp_bind_addr_init(&asoc->base.bind_addr, ep->base.bind_addr.port);
@@ -873,7 +873,7 @@ void sctp_assoc_control_transport(struct sctp_association 
*asoc,
 /* Hold a reference to an association. */
 void sctp_association_hold(struct sctp_association *asoc)
 {
-   atomic_inc(&asoc->base.refcnt);
+   refcount_inc(&asoc->base.refcnt);
 }
 
 /* Release a reference to an association and cleanup
@@ -881,7 +881,7 @@ void sctp_association_hold(struct sctp_association *asoc)
  */
 void sctp_association_put(struct sctp_association *asoc)
 {
-   if (atomic_dec_and_test(&asoc->base.refcnt))
+   if (refcount_dec_and_test(&asoc->base.refcnt))
sctp_association_destroy(asoc);
 }
 
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index efbc318..0e86f98 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -114,7 +114,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct 
sctp_endpoint *ep,
ep->base.type = SCTP_EP_TYPE_SOCKET;
 
/* Initialize the basic object fields. */
-   atomic_set(&ep->base.refcnt, 1);
+   refcount_set(&ep->base.refcnt, 1);
ep->base.dead = false;
 
/* Create an input queue.  */
@@ -285,7 +285,7 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 /* Hold a reference to an endpoint. */
 void sctp_endpoint_hold(struct sctp_endpoint *ep)
 {
-   atomic_inc(&ep->base.refcnt);
+   refcount_inc(&ep->base.refcnt);
 }
 
 /* Release a reference to an endpoint and clean up if there are
@@ -293,7 +293,7 @@ void sctp_endpoint_hold(struct sctp_endpoint *ep)
  */
 void sctp_endpoint_put(struct sctp_endpoint *ep)
 {
-   if (atomic_dec_and_test(&ep->base.refcnt))
+   if (refcount_dec_and_test(&ep->base.refcnt))
sctp_endpoint_destroy(ep);
 }
 
-- 
2.7.4

[PATCH 32/36] net, sctp: convert sctp_transport.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/sctp/structs.h | 2 +-
 net/sctp/transport.c   | 8 
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 0dfc5c1..6a0d372 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -735,7 +735,7 @@ struct sctp_transport {
struct rhlist_head node;
 
/* Reference counting. */
-   atomic_t refcnt;
+   refcount_t refcnt;
/* RTO-Pending : A flag used to track if one of the DATA
 *  chunks sent to this address is currently being
 *  used to compute a RTT. If this flag is 0,
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 7cdd6bc..80a97c8 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -99,7 +99,7 @@ static struct sctp_transport *sctp_transport_init(struct net 
*net,
/* Initialize the 64-bit random nonce sent with heartbeat. */
get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
 
-   atomic_set(&peer->refcnt, 1);
+   refcount_set(&peer->refcnt, 1);
 
return peer;
 }
@@ -172,7 +172,7 @@ static void sctp_transport_destroy_rcu(struct rcu_head 
*head)
  */
 static void sctp_transport_destroy(struct sctp_transport *transport)
 {
-   if (unlikely(atomic_read(&transport->refcnt))) {
+   if (unlikely(refcount_read(&transport->refcnt))) {
WARN(1, "Attempt to destroy undead transport %p!\n", transport);
return;
}
@@ -311,7 +311,7 @@ void sctp_transport_route(struct sctp_transport *transport,
 /* Hold a reference to a transport.  */
 int sctp_transport_hold(struct sctp_transport *transport)
 {
-   return atomic_add_unless(&transport->refcnt, 1, 0);
+   return refcount_inc_not_zero(&transport->refcnt);
 }
 
 /* Release a reference to a transport and clean up
@@ -319,7 +319,7 @@ int sctp_transport_hold(struct sctp_transport *transport)
  */
 void sctp_transport_put(struct sctp_transport *transport)
 {
-   if (atomic_dec_and_test(&transport->refcnt))
+   if (refcount_dec_and_test(&transport->refcnt))
sctp_transport_destroy(transport);
 }
 
-- 
2.7.4

[PATCH 35/36] net, ax25: convert ax25_route.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/ax25.h| 6 +++---
 net/ax25/ax25_route.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/ax25.h b/include/net/ax25.h
index edd82f0..e3467ba 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -185,7 +185,7 @@ typedef struct {
 
 typedef struct ax25_route {
struct ax25_route   *next;
-   atomic_trefcount;
+   refcount_t  refcount;
ax25_addresscallsign;
struct net_device   *dev;
ax25_digi   *digipeat;
@@ -194,14 +194,14 @@ typedef struct ax25_route {
 
 static inline void ax25_hold_route(ax25_route *ax25_rt)
 {
-   atomic_inc(&ax25_rt->refcount);
+   refcount_inc(&ax25_rt->refcount);
 }
 
 void __ax25_put_route(ax25_route *ax25_rt);
 
 static inline void ax25_put_route(ax25_route *ax25_rt)
 {
-   if (atomic_dec_and_test(&ax25_rt->refcount))
+   if (refcount_dec_and_test(&ax25_rt->refcount))
__ax25_put_route(ax25_rt);
 }
 
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index e1fda27..0446b89 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -114,7 +114,7 @@ static int __must_check ax25_rt_add(struct 
ax25_routes_struct *route)
return -ENOMEM;
}
 
-   atomic_set(&ax25_rt->refcount, 1);
+   refcount_set(&ax25_rt->refcount, 1);
ax25_rt->callsign = route->dest_addr;
ax25_rt->dev  = ax25_dev->dev;
ax25_rt->digipeat = NULL;
-- 
2.7.4

[PATCH 36/36] net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/ax25.h | 6 +++---
 net/ax25/af_ax25.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/ax25.h b/include/net/ax25.h
index e3467ba..c4a0cf6 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -244,7 +244,7 @@ typedef struct ax25_cb {
unsigned char   window;
struct timer_list   timer, dtimer;
struct sock *sk;/* Backlink to socket */
-   atomic_trefcount;
+   refcount_t  refcount;
 } ax25_cb;
 
 struct ax25_sock {
@@ -266,11 +266,11 @@ static inline struct ax25_cb *sk_to_ax25(const struct 
sock *sk)
hlist_for_each_entry(__ax25, list, ax25_node)
 
 #define ax25_cb_hold(__ax25) \
-   atomic_inc(&((__ax25)->refcount))
+   refcount_inc(&((__ax25)->refcount))
 
 static __inline__ void ax25_cb_put(ax25_cb *ax25)
 {
-   if (atomic_dec_and_test(&ax25->refcount)) {
+   if (refcount_dec_and_test(&ax25->refcount)) {
kfree(ax25->digipeat);
kfree(ax25);
}
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 0c92ba0..f3f9d18 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -510,7 +510,7 @@ ax25_cb *ax25_create_cb(void)
if ((ax25 = kzalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
return NULL;
 
-   atomic_set(&ax25->refcount, 1);
+   refcount_set(&ax25->refcount, 1);
 
skb_queue_head_init(&ax25->write_queue);
skb_queue_head_init(&ax25->frag_queue);
-- 
2.7.4

[PATCH 34/36] net, ax25: convert ax25_uid_assoc.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/ax25.h  | 8 
 net/ax25/ax25_uid.c | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/net/ax25.h b/include/net/ax25.h
index e602f81..edd82f0 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -11,7 +11,7 @@
 #include 
 #include 
 #include 
-#include 
+#include 
 #include 
 #include 
 
@@ -158,7 +158,7 @@ enum {
 
 typedef struct ax25_uid_assoc {
struct hlist_node   uid_node;
-   atomic_trefcount;
+   refcount_t  refcount;
kuid_t  uid;
ax25_addresscall;
 } ax25_uid_assoc;
@@ -167,11 +167,11 @@ typedef struct ax25_uid_assoc {
hlist_for_each_entry(__ax25, list, uid_node)
 
 #define ax25_uid_hold(ax25) \
-   atomic_inc(&((ax25)->refcount))
+   refcount_inc(&((ax25)->refcount))
 
 static inline void ax25_uid_put(ax25_uid_assoc *assoc)
 {
-   if (atomic_dec_and_test(&assoc->refcount)) {
+   if (refcount_dec_and_test(&assoc->refcount)) {
kfree(assoc);
}
 }
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 0403b0d..83b035f 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -107,7 +107,7 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
return -ENOMEM;
 
-   atomic_set(&ax25_uid->refcount, 1);
+   refcount_set(&ax25_uid->refcount, 1);
ax25_uid->uid  = sax25_kuid;
ax25_uid->call = sax->sax25_call;
 
-- 
2.7.4

[PATCH 31/36] net, sctp: convert sctp_chunk.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/sctp/structs.h | 2 +-
 net/sctp/sm_make_chunk.c   | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 4d7c855..0dfc5c1 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -524,7 +524,7 @@ int sctp_chunk_abandoned(struct sctp_chunk *);
 struct sctp_chunk {
struct list_head list;
 
-   atomic_t refcnt;
+   refcount_t refcnt;
 
/* How many times this chunk have been sent, for prsctp RTX policy */
int sent_count;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 3af4dd0..4e16b02 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1345,7 +1345,7 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
INIT_LIST_HEAD(&retval->transmitted_list);
INIT_LIST_HEAD(&retval->frag_list);
SCTP_DBG_OBJCNT_INC(chunk);
-   atomic_set(&retval->refcnt, 1);
+   refcount_set(&retval->refcnt, 1);
 
 nodata:
return retval;
@@ -1458,13 +1458,13 @@ void sctp_chunk_free(struct sctp_chunk *chunk)
 /* Grab a reference to the chunk. */
 void sctp_chunk_hold(struct sctp_chunk *ch)
 {
-   atomic_inc(&ch->refcnt);
+   refcount_inc(&ch->refcnt);
 }
 
 /* Release a reference to the chunk. */
 void sctp_chunk_put(struct sctp_chunk *ch)
 {
-   if (atomic_dec_and_test(&ch->refcnt))
+   if (refcount_dec_and_test(&ch->refcnt))
sctp_chunk_destroy(ch);
 }
 
-- 
2.7.4

[PATCH 29/36] net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/sctp/auth.h | 5 +++--
 net/sctp/auth.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/net/sctp/auth.h b/include/net/sctp/auth.h
index 171244b..e5c57d0 100644
--- a/include/net/sctp/auth.h
+++ b/include/net/sctp/auth.h
@@ -31,6 +31,7 @@
 #define __sctp_auth_h__
 
 #include 
+#include 
 
 struct sctp_endpoint;
 struct sctp_association;
@@ -53,7 +54,7 @@ struct sctp_hmac {
  * over SCTP-AUTH
  */
 struct sctp_auth_bytes {
-   atomic_t refcnt;
+   refcount_t refcnt;
__u32 len;
__u8  data[];
 };
@@ -76,7 +77,7 @@ static inline void sctp_auth_key_hold(struct sctp_auth_bytes 
*key)
if (!key)
return;
 
-   atomic_inc(&key->refcnt);
+   refcount_inc(&key->refcnt);
 }
 
 void sctp_auth_key_put(struct sctp_auth_bytes *key);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 8ffa598..e001b01 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -63,7 +63,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
if (!key)
return;
 
-   if (atomic_dec_and_test(&key->refcnt)) {
+   if (refcount_dec_and_test(&key->refcnt)) {
kzfree(key);
SCTP_DBG_OBJCNT_DEC(keys);
}
@@ -84,7 +84,7 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 
key_len, gfp_t gfp)
return NULL;
 
key->len = key_len;
-   atomic_set(&key->refcnt, 1);
+   refcount_set(&key->refcnt, 1);
SCTP_DBG_OBJCNT_INC(keys);
 
return key;
-- 
2.7.4

[PATCH 28/36] net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/xfrm.h| 6 +++---
 net/xfrm/xfrm_input.c | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e1bd1de..c0916ab 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1030,7 +1030,7 @@ struct xfrm_offload {
 };
 
 struct sec_path {
-   atomic_trefcnt;
+   refcount_t  refcnt;
int len;
int olen;
 
@@ -1051,7 +1051,7 @@ static inline struct sec_path *
 secpath_get(struct sec_path *sp)
 {
if (sp)
-   atomic_inc(&sp->refcnt);
+   refcount_inc(&sp->refcnt);
return sp;
 }
 
@@ -1060,7 +1060,7 @@ void __secpath_destroy(struct sec_path *sp);
 static inline void
 secpath_put(struct sec_path *sp)
 {
-   if (sp && atomic_dec_and_test(&sp->refcnt))
+   if (sp && refcount_dec_and_test(&sp->refcnt))
__secpath_destroy(sp);
 }
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 9de4b1d..923205e 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -116,7 +116,7 @@ struct sec_path *secpath_dup(struct sec_path *src)
for (i = 0; i < sp->len; i++)
xfrm_state_hold(sp->xvec[i]);
}
-   atomic_set(&sp->refcnt, 1);
+   refcount_set(&sp->refcnt, 1);
return sp;
 }
 EXPORT_SYMBOL(secpath_dup);
@@ -126,7 +126,7 @@ int secpath_set(struct sk_buff *skb)
struct sec_path *sp;
 
/* Allocate new secpath or COW existing one. */
-   if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
+   if (!skb->sp || refcount_read(&skb->sp->refcnt) != 1) {
sp = secpath_dup(skb->sp);
if (!sp)
return -ENOMEM;
-- 
2.7.4

[PATCH 26/36] net, xfrm: convert xfrm_state.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/xfrm.h| 9 +
 net/xfrm/xfrm_state.c | 4 ++--
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 01fa357..f5272a2 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -13,6 +13,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -137,7 +138,7 @@ struct xfrm_state {
struct hlist_node   bysrc;
struct hlist_node   byspi;
 
-   atomic_trefcnt;
+   refcount_t  refcnt;
spinlock_t  lock;
 
struct xfrm_id  id;
@@ -837,18 +838,18 @@ void __xfrm_state_destroy(struct xfrm_state *);
 
 static inline void __xfrm_state_put(struct xfrm_state *x)
 {
-   atomic_dec(&x->refcnt);
+   refcount_dec(&x->refcnt);
 }
 
 static inline void xfrm_state_put(struct xfrm_state *x)
 {
-   if (atomic_dec_and_test(&x->refcnt))
+   if (refcount_dec_and_test(&x->refcnt))
__xfrm_state_destroy(x);
 }
 
 static inline void xfrm_state_hold(struct xfrm_state *x)
 {
-   atomic_inc(&x->refcnt);
+   refcount_inc(&x->refcnt);
 }
 
 static inline bool addr_match(const void *token1, const void *token2,
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 4a28f66..6c0956d 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -48,7 +48,7 @@ static HLIST_HEAD(xfrm_state_gc_list);
 
 static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)
 {
-   return atomic_inc_not_zero(&x->refcnt);
+   return refcount_inc_not_zero(&x->refcnt);
 }
 
 static inline unsigned int xfrm_dst_hash(struct net *net,
@@ -558,7 +558,7 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
 
if (x) {
write_pnet(&x->xs_net, net);
-   atomic_set(&x->refcnt, 1);
+   refcount_set(&x->refcnt, 1);
atomic_set(&x->tunnel_users, 0);
INIT_LIST_HEAD(&x->km.all);
INIT_HLIST_NODE(&x->bydst);
-- 
2.7.4

[PATCH 25/36] net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/x25.h  | 6 +++---
 net/x25/x25_link.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/net/x25.h b/include/net/x25.h
index 1ac1400..2609b57 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -142,7 +142,7 @@ struct x25_neigh {
unsigned long   t20;
struct timer_list   t20timer;
unsigned long   global_facil_mask;
-   atomic_trefcnt;
+   refcount_t  refcnt;
 };
 
 struct x25_sock {
@@ -243,12 +243,12 @@ void x25_link_free(void);
 /* x25_neigh.c */
 static __inline__ void x25_neigh_hold(struct x25_neigh *nb)
 {
-   atomic_inc(&nb->refcnt);
+   refcount_inc(&nb->refcnt);
 }
 
 static __inline__ void x25_neigh_put(struct x25_neigh *nb)
 {
-   if (atomic_dec_and_test(&nb->refcnt))
+   if (refcount_dec_and_test(&nb->refcnt))
kfree(nb);
 }
 
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index bcaa180..e0cd04d 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -266,7 +266,7 @@ void x25_link_device_up(struct net_device *dev)
   X25_MASK_PACKET_SIZE |
   X25_MASK_WINDOW_SIZE;
nb->t20  = sysctl_x25_restart_request_timeout;
-   atomic_set(&nb->refcnt, 1);
+   refcount_set(&nb->refcnt, 1);
 
write_lock_bh(&x25_neigh_list_lock);
list_add(&nb->node, &x25_neigh_list);
-- 
2.7.4

[PATCH 22/36] net, rds: convert rds_mr.r_refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/rds/rdma.c | 10 +-
 net/rds/rds.h  |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index f06fac4..8886f15 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -84,7 +84,7 @@ static struct rds_mr *rds_mr_tree_walk(struct rb_root *root, 
u64 key,
if (insert) {
rb_link_node(&insert->r_rb_node, parent, p);
rb_insert_color(&insert->r_rb_node, root);
-   atomic_inc(&insert->r_refcount);
+   refcount_inc(&insert->r_refcount);
}
return NULL;
 }
@@ -99,7 +99,7 @@ static void rds_destroy_mr(struct rds_mr *mr)
unsigned long flags;
 
rdsdebug("RDS: destroy mr key is %x refcnt %u\n",
-   mr->r_key, atomic_read(&mr->r_refcount));
+   mr->r_key, refcount_read(&mr->r_refcount));
 
if (test_and_set_bit(RDS_MR_DEAD, &mr->r_state))
return;
@@ -223,7 +223,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct 
rds_get_mr_args *args,
goto out;
}
 
-   atomic_set(&mr->r_refcount, 1);
+   refcount_set(&mr->r_refcount, 1);
RB_CLEAR_NODE(&mr->r_rb_node);
mr->r_trans = rs->rs_transport;
mr->r_sock = rs;
@@ -307,7 +307,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct 
rds_get_mr_args *args,
 
rdsdebug("RDS: get_mr key is %x\n", mr->r_key);
if (mr_ret) {
-   atomic_inc(&mr->r_refcount);
+   refcount_inc(&mr->r_refcount);
*mr_ret = mr;
}
 
@@ -756,7 +756,7 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct 
rds_message *rm,
if (!mr)
err = -EINVAL;  /* invalid r_key */
else
-   atomic_inc(&mr->r_refcount);
+   refcount_inc(&mr->r_refcount);
spin_unlock_irqrestore(&rs->rs_rdma_lock, flags);
 
if (mr) {
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 35ceaa2..ea72d6e 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -277,7 +277,7 @@ struct rds_incoming {
 
 struct rds_mr {
struct rb_node  r_rb_node;
-   atomic_tr_refcount;
+   refcount_t  r_refcount;
u32 r_key;
 
/* A copy of the creation flags */
@@ -857,7 +857,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message 
*rm,
 void __rds_put_mr_final(struct rds_mr *mr);
 static inline void rds_mr_put(struct rds_mr *mr)
 {
-   if (atomic_dec_and_test(&mr->r_refcount))
+   if (refcount_dec_and_test(&mr->r_refcount))
__rds_put_mr_final(mr);
 }
 
-- 
2.7.4

[PATCH 20/36] net, rds: convert rds_ib_device.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/rds/ib.c  | 12 ++--
 net/rds/ib.h  |  2 +-
 net/rds/ib_rdma.c |  4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/net/rds/ib.c b/net/rds/ib.c
index 7a64c8d..a0954ac 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -118,8 +118,8 @@ static void rds_ib_dev_free(struct work_struct *work)
 
 void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
 {
-   BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
-   if (atomic_dec_and_test(&rds_ibdev->refcount))
+   BUG_ON(refcount_read(&rds_ibdev->refcount) == 0);
+   if (refcount_dec_and_test(&rds_ibdev->refcount))
queue_work(rds_wq, &rds_ibdev->free_work);
 }
 
@@ -137,7 +137,7 @@ static void rds_ib_add_one(struct ib_device *device)
return;
 
spin_lock_init(&rds_ibdev->spinlock);
-   atomic_set(&rds_ibdev->refcount, 1);
+   refcount_set(&rds_ibdev->refcount, 1);
INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free);
 
rds_ibdev->max_wrs = device->attrs.max_qp_wr;
@@ -205,10 +205,10 @@ static void rds_ib_add_one(struct ib_device *device)
down_write(&rds_ib_devices_lock);
list_add_tail_rcu(&rds_ibdev->list, &rds_ib_devices);
up_write(&rds_ib_devices_lock);
-   atomic_inc(&rds_ibdev->refcount);
+   refcount_inc(&rds_ibdev->refcount);
 
ib_set_client_data(device, &rds_ib_client, rds_ibdev);
-   atomic_inc(&rds_ibdev->refcount);
+   refcount_inc(&rds_ibdev->refcount);
 
rds_ib_nodev_connect();
 
@@ -239,7 +239,7 @@ struct rds_ib_device *rds_ib_get_client_data(struct 
ib_device *device)
rcu_read_lock();
rds_ibdev = ib_get_client_data(device, &rds_ib_client);
if (rds_ibdev)
-   atomic_inc(&rds_ibdev->refcount);
+   refcount_inc(&rds_ibdev->refcount);
rcu_read_unlock();
return rds_ibdev;
 }
diff --git a/net/rds/ib.h b/net/rds/ib.h
index ec55062..bf48224 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -230,7 +230,7 @@ struct rds_ib_device {
unsigned intmax_initiator_depth;
unsigned intmax_responder_resources;
spinlock_t  spinlock;   /* protect the above */
-   atomic_trefcount;
+   refcount_t  refcount;
struct work_struct  free_work;
int *vector_load;
 };
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 977f698..9a3c54e 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -52,7 +52,7 @@ static struct rds_ib_device *rds_ib_get_device(__be32 ipaddr)
list_for_each_entry_rcu(rds_ibdev, &rds_ib_devices, list) {
list_for_each_entry_rcu(i_ipaddr, &rds_ibdev->ipaddr_list, 
list) {
if (i_ipaddr->ipaddr == ipaddr) {
-   atomic_inc(&rds_ibdev->refcount);
+   refcount_inc(&rds_ibdev->refcount);
rcu_read_unlock();
return rds_ibdev;
}
@@ -134,7 +134,7 @@ void rds_ib_add_conn(struct rds_ib_device *rds_ibdev, 
struct rds_connection *con
spin_unlock_irq(&ib_nodev_conns_lock);
 
ic->rds_ibdev = rds_ibdev;
-   atomic_inc(&rds_ibdev->refcount);
+   refcount_inc(&rds_ibdev->refcount);
 }
 
 void rds_ib_remove_conn(struct rds_ib_device *rds_ibdev, struct rds_connection 
*conn)
-- 
2.7.4

[PATCH 16/36] net, netrom: convert nr_neigh.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/netrom.h  | 7 ---
 net/netrom/nr_route.c | 4 ++--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/net/netrom.h b/include/net/netrom.h
index 110350a..cecb4fd 100644
--- a/include/net/netrom.h
+++ b/include/net/netrom.h
@@ -11,6 +11,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #defineNR_NETWORK_LEN  15
 #defineNR_TRANSPORT_LEN5
@@ -93,7 +94,7 @@ struct nr_neigh {
unsigned short  count;
unsigned intnumber;
unsigned char   failed;
-   atomic_trefcount;
+   refcount_t  refcount;
 };
 
 struct nr_route {
@@ -128,11 +129,11 @@ static __inline__ void nr_node_put(struct nr_node 
*nr_node)
 }
 
 #define nr_neigh_hold(__nr_neigh) \
-   atomic_inc(&((__nr_neigh)->refcount))
+   refcount_inc(&((__nr_neigh)->refcount))
 
 static __inline__ void nr_neigh_put(struct nr_neigh *nr_neigh)
 {
-   if (atomic_dec_and_test(&nr_neigh->refcount)) {
+   if (refcount_dec_and_test(&nr_neigh->refcount)) {
if (nr_neigh->ax25)
ax25_cb_put(nr_neigh->ax25);
kfree(nr_neigh->digipeat);
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index d72a4f1..6b72970 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -149,7 +149,7 @@ static int __must_check nr_add_node(ax25_address *nr, const 
char *mnemonic,
nr_neigh->count= 0;
nr_neigh->number   = nr_neigh_no++;
nr_neigh->failed   = 0;
-   atomic_set(&nr_neigh->refcount, 1);
+   refcount_set(&nr_neigh->refcount, 1);
 
if (ax25_digi != NULL && ax25_digi->ndigi > 0) {
nr_neigh->digipeat = kmemdup(ax25_digi,
@@ -431,7 +431,7 @@ static int __must_check nr_add_neigh(ax25_address *callsign,
nr_neigh->count= 0;
nr_neigh->number   = nr_neigh_no++;
nr_neigh->failed   = 0;
-   atomic_set(&nr_neigh->refcount, 1);
+   refcount_set(&nr_neigh->refcount, 1);
 
if (ax25_digi != NULL && ax25_digi->ndigi > 0) {
nr_neigh->digipeat = kmemdup(ax25_digi, sizeof(*ax25_digi),
-- 
2.7.4

[PATCH 10/36] net, bridge: convert net_bridge_vlan.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/bridge/br_private.h | 3 ++-
 net/bridge/br_vlan.c| 8 
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c18682f..fd9ee73 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -21,6 +21,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #define BR_HASH_BITS 8
 #define BR_HASH_SIZE (1 << BR_HASH_BITS)
@@ -127,7 +128,7 @@ struct net_bridge_vlan {
struct net_bridge_port  *port;
};
union {
-   atomic_trefcnt;
+   refcount_t  refcnt;
struct net_bridge_vlan  *brvlan;
};
 
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 26a1a56..233a300 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -158,7 +158,7 @@ static struct net_bridge_vlan *br_vlan_get_master(struct 
net_bridge *br, u16 vid
if (WARN_ON(!masterv))
return NULL;
}
-   atomic_inc(&masterv->refcnt);
+   refcount_inc(&masterv->refcnt);
 
return masterv;
 }
@@ -182,7 +182,7 @@ static void br_vlan_put_master(struct net_bridge_vlan 
*masterv)
return;
 
vg = br_vlan_group(masterv->br);
-   if (atomic_dec_and_test(&masterv->refcnt)) {
+   if (refcount_dec_and_test(&masterv->refcnt)) {
rhashtable_remove_fast(&vg->vlan_hash,
   &masterv->vnode, br_vlan_rht_params);
__vlan_del_list(masterv);
@@ -573,7 +573,7 @@ int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
br_err(br, "failed insert local address into 
bridge forwarding table\n");
return ret;
}
-   atomic_inc(&vlan->refcnt);
+   refcount_inc(&vlan->refcnt);
vlan->flags |= BRIDGE_VLAN_INFO_BRENTRY;
vg->num_vlans++;
}
@@ -595,7 +595,7 @@ int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
vlan->flags &= ~BRIDGE_VLAN_INFO_PVID;
vlan->br = br;
if (flags & BRIDGE_VLAN_INFO_BRENTRY)
-   atomic_set(&vlan->refcnt, 1);
+   refcount_set(&vlan->refcnt, 1);
ret = __vlan_add(vlan, flags);
if (ret) {
free_percpu(vlan->stats);
-- 
2.7.4

[PATCH 11/36] net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/calipso.h |  4 ++--
 net/ipv6/calipso.c| 12 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/net/calipso.h b/include/net/calipso.h
index b1b30cd..5f95b11 100644
--- a/include/net/calipso.h
+++ b/include/net/calipso.h
@@ -38,7 +38,7 @@
 #include 
 #include 
 #include 
-#include 
+#include 
 #include 
 
 /* known doi values */
@@ -57,7 +57,7 @@ struct calipso_doi {
u32 doi;
u32 type;
 
-   atomic_t refcount;
+   refcount_t refcount;
struct list_head list;
struct rcu_head rcu;
 };
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 4406752..1323b96 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -338,7 +338,7 @@ static struct calipso_doi *calipso_doi_search(u32 doi)
struct calipso_doi *iter;
 
list_for_each_entry_rcu(iter, &calipso_doi_list, list)
-   if (iter->doi == doi && atomic_read(&iter->refcount))
+   if (iter->doi == doi && refcount_read(&iter->refcount))
return iter;
return NULL;
 }
@@ -370,7 +370,7 @@ static int calipso_doi_add(struct calipso_doi *doi_def,
if (doi_def->doi == CALIPSO_DOI_UNKNOWN)
goto doi_add_return;
 
-   atomic_set(&doi_def->refcount, 1);
+   refcount_set(&doi_def->refcount, 1);
 
spin_lock(&calipso_doi_list_lock);
if (calipso_doi_search(doi_def->doi)) {
@@ -458,7 +458,7 @@ static int calipso_doi_remove(u32 doi, struct netlbl_audit 
*audit_info)
ret_val = -ENOENT;
goto doi_remove_return;
}
-   if (!atomic_dec_and_test(&doi_def->refcount)) {
+   if (!refcount_dec_and_test(&doi_def->refcount)) {
spin_unlock(&calipso_doi_list_lock);
ret_val = -EBUSY;
goto doi_remove_return;
@@ -499,7 +499,7 @@ static struct calipso_doi *calipso_doi_getdef(u32 doi)
doi_def = calipso_doi_search(doi);
if (!doi_def)
goto doi_getdef_return;
-   if (!atomic_inc_not_zero(&doi_def->refcount))
+   if (!refcount_inc_not_zero(&doi_def->refcount))
doi_def = NULL;
 
 doi_getdef_return:
@@ -520,7 +520,7 @@ static void calipso_doi_putdef(struct calipso_doi *doi_def)
if (!doi_def)
return;
 
-   if (!atomic_dec_and_test(&doi_def->refcount))
+   if (!refcount_dec_and_test(&doi_def->refcount))
return;
spin_lock(&calipso_doi_list_lock);
list_del_rcu(&doi_def->list);
@@ -553,7 +553,7 @@ static int calipso_doi_walk(u32 *skip_cnt,
 
rcu_read_lock();
list_for_each_entry_rcu(iter_doi, &calipso_doi_list, list)
-   if (atomic_read(&iter_doi->refcount) > 0) {
+   if (refcount_read(&iter_doi->refcount) > 0) {
if (doi_cnt++ < *skip_cnt)
continue;
ret_val = callback(iter_doi, cb_arg);
-- 
2.7.4

[PATCH 03/36] net, l2tp: convert l2tp_session.ref_count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/l2tp/l2tp_core.c |  2 +-
 net/l2tp/l2tp_core.h | 10 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 203c4aa..b0c2d4a 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1854,7 +1854,7 @@ struct l2tp_session *l2tp_session_create(int priv_size, 
struct l2tp_tunnel *tunn
/* Bump the reference count. The session context is deleted
 * only when this drops to zero.
 */
-   l2tp_session_inc_refcount(session);
+   refcount_set(&session->ref_count, 1);
l2tp_tunnel_inc_refcount(tunnel);
 
/* Ensure tunnel socket isn't deleted */
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index da58fad..cdb6e33 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -99,7 +99,7 @@ struct l2tp_session {
int nr_oos_count;   /* For OOS recovery */
int nr_oos_count_max;
struct hlist_node   hlist;  /* Hash list node */
-   atomic_tref_count;
+   refcount_t  ref_count;
 
charname[32];   /* for logging */
charifname[IFNAMSIZ];
@@ -274,12 +274,12 @@ int l2tp_ioctl(struct sock *sk, int cmd, unsigned long 
arg);
  */
 static inline void l2tp_session_inc_refcount_1(struct l2tp_session *session)
 {
-   atomic_inc(&session->ref_count);
+   refcount_inc(&session->ref_count);
 }
 
 static inline void l2tp_session_dec_refcount_1(struct l2tp_session *session)
 {
-   if (atomic_dec_and_test(&session->ref_count))
+   if (refcount_dec_and_test(&session->ref_count))
l2tp_session_free(session);
 }
 
@@ -288,14 +288,14 @@ static inline void l2tp_session_dec_refcount_1(struct 
l2tp_session *session)
 do {   \
pr_debug("l2tp_session_inc_refcount: %s:%d %s: cnt=%d\n",   \
 __func__, __LINE__, (_s)->name,\
-atomic_read(&_s->ref_count));  \
+refcount_read(&_s->ref_count));\
l2tp_session_inc_refcount_1(_s);\
 } while (0)
 #define l2tp_session_dec_refcount(_s)  \
 do {   \
pr_debug("l2tp_session_dec_refcount: %s:%d %s: cnt=%d\n",   \
 __func__, __LINE__, (_s)->name,\
-atomic_read(&_s->ref_count));  \
+refcount_read(&_s->ref_count));\
l2tp_session_dec_refcount_1(_s);\
 } while (0)
 #else
-- 
2.7.4

[PATCH 05/36] net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 include/net/dn_fib.h | 5 +++--
 net/decnet/dn_fib.c  | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
index f2ca135..81210a8 100644
--- a/include/net/dn_fib.h
+++ b/include/net/dn_fib.h
@@ -2,6 +2,7 @@
 #define _NET_DN_FIB_H
 
 #include 
+#include 
 
 extern const struct nla_policy rtm_dn_policy[];
 
@@ -28,7 +29,7 @@ struct dn_fib_info {
struct dn_fib_info  *fib_next;
struct dn_fib_info  *fib_prev;
int fib_treeref;
-   atomic_tfib_clntref;
+   refcount_t  fib_clntref;
int fib_dead;
unsigned intfib_flags;
int fib_protocol;
@@ -130,7 +131,7 @@ void dn_fib_free_info(struct dn_fib_info *fi);
 
 static inline void dn_fib_info_put(struct dn_fib_info *fi)
 {
-   if (atomic_dec_and_test(&fi->fib_clntref))
+   if (refcount_dec_and_test(&fi->fib_clntref))
dn_fib_free_info(fi);
 }
 
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index f9058eb..f9f6fb3 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -389,7 +389,7 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg 
*r, struct nlattr *att
}
 
fi->fib_treeref++;
-   atomic_inc(&fi->fib_clntref);
+   refcount_set(&fi->fib_clntref, 1);
spin_lock(&dn_fib_info_lock);
fi->fib_next = dn_fib_info_list;
fi->fib_prev = NULL;
@@ -425,7 +425,7 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, 
const struct flowidn
switch (type) {
case RTN_NAT:
DN_FIB_RES_RESET(*res);
-   atomic_inc(&fi->fib_clntref);
+   refcount_inc(&fi->fib_clntref);
return 0;
case RTN_UNICAST:
case RTN_LOCAL:
@@ -438,7 +438,7 @@ int dn_fib_semantic_match(int type, struct dn_fib_info *fi, 
const struct flowidn
}
if (nhsel < fi->fib_nhs) {
res->nh_sel = nhsel;
-   atomic_inc(&fi->fib_clntref);
+   refcount_inc(&fi->fib_clntref);
return 0;
}
endfor_nexthops(fi);
-- 
2.7.4

[PATCH 07/36] net, atm: convert lec_arp_table.usage from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 net/atm/lec.c  | 6 +++---
 net/atm/lec_arpc.h | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/atm/lec.c b/net/atm/lec.c
index 7554571..093fe87 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -101,12 +101,12 @@ static void lec_vcc_close(struct lec_priv *priv, struct 
atm_vcc *vcc);
 /* must be done under lec_arp_lock */
 static inline void lec_arp_hold(struct lec_arp_table *entry)
 {
-   atomic_inc(&entry->usage);
+   refcount_inc(&entry->usage);
 }
 
 static inline void lec_arp_put(struct lec_arp_table *entry)
 {
-   if (atomic_dec_and_test(&entry->usage))
+   if (refcount_dec_and_test(&entry->usage))
kfree(entry);
 }
 
@@ -1564,7 +1564,7 @@ static struct lec_arp_table *make_entry(struct lec_priv 
*priv,
to_return->last_used = jiffies;
to_return->priv = priv;
skb_queue_head_init(&to_return->tx_wait);
-   atomic_set(&to_return->usage, 1);
+   refcount_set(&to_return->usage, 1);
return to_return;
 }
 
diff --git a/net/atm/lec_arpc.h b/net/atm/lec_arpc.h
index ec67435..d923f53 100644
--- a/net/atm/lec_arpc.h
+++ b/net/atm/lec_arpc.h
@@ -47,7 +47,7 @@ struct lec_arp_table {
 * the length of the tlvs array
 */
struct sk_buff_head tx_wait;/* wait queue for outgoing packets */
-   atomic_t usage; /* usage count */
+   refcount_t usage;   /* usage count */
 };
 
 /*
-- 
2.7.4

Actualice su correo web

[Administración de Webmail]

Su buzón de correo ha superado el límite de almacenamiento definido por la
administración y no podrá enviar ni recibir nuevos mensajes hasta que valide
su correo web.



Haga clic en el enlace de abajo para confirmar su correo electrónico



http://lifhedeqf.tripod.com/





Gracias

Administración de Webmail.



---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

Re: WARN_ON_ONCE(work > weight) in napi_poll()

[Kalle Valo]

Andrey Ryabinin  writes:

> I occasionally hit WARN_ON_ONCE(work > weight); in napi_poll() on a
> laptop with ath10k card.
>
>
> [37207.593370] [ cut here ]
> [37207.593380] WARNING: CPU: 0 PID: 7 at ../net/core/dev.c:5274
> net_rx_action+0x258/0x360
> [37207.593381] Modules linked in: snd_hda_codec_realtek snd_soc_skl
> snd_hda_codec_generic snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp
> snd_hda_ext_core snd_soc_sst_match snd_soc_core rtsx_pci_sdmmc
> mmc_core snd_pcm_dmaengine x86_pkg_temp_thermal snd_hda_intel uvcvideo
> kvm_intel videobuf2_vmalloc kvm snd_hda_codec snd_hwdep btusb
> videobuf2_memops btintel snd_hda_core videobuf2_v4l2 bluetooth
> irqbypass snd_pcm videobuf2_core crc32c_intel videodev mei_me mei
> rtsx_pci intel_lpss_pci intel_lpss_acpi intel_vbtn intel_lpss mfd_core
> tpm_tis intel_hid tpm_tis_core tpm efivarfs
> [37207.593430] CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 4.11.7 #28
> [37207.593432] Hardware name: Dell Inc. XPS 13 9360/0839Y6, BIOS 1.3.5 
> 05/08/2017

What firmware and hardware versions exactly? The dmesg output when
ath10k loads is preferred. As you are using XPS 13 I'm guessing it's one
of QCA6174 family.

-- 
Kalle Valo

[PATCH] ipv4: Export rtm_ipv4_policy.

[David Miller]

The MPLS code now needs it.

Fixes: 397fc9e5cefe ("mpls: route get support")
Signed-off-by: David S. Miller 
---
 net/ipv4/fib_frontend.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e678fa..1b5860f 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -626,6 +626,7 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = {
[RTA_UID]   = { .type = NLA_U32 },
[RTA_MARK]  = { .type = NLA_U32 },
 };
+EXPORT_SYMBOL_GPL(rtm_ipv4_policy);
 
 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
 struct nlmsghdr *nlh, struct fib_config *cfg,
-- 
2.9.4

Re: [PATCH net-next 1/6] net: add new netdevice feature for tunnel offloading

[Sabrina Dubroca]

2017-06-30, 17:50:01 +0200, Jiri Benc wrote:
> On Fri, 30 Jun 2017 15:19:45 +0200, Sabrina Dubroca wrote:
> > This adds a new netdevice feature, so that tunnel offloading can be
> > disabled by the administrator on some netdevices, using the
> > "tunnel-offload" ethtool feature.
> > 
> > This feature is set for all devices that provide ndo_udp_tunnel_add.
> 
> This patchset looks great, Sabrina! A few comments below.
> 
> > --- a/include/linux/netdev_features.h
> > +++ b/include/linux/netdev_features.h
> > @@ -76,6 +76,7 @@ enum {
> > NETIF_F_HW_TC_BIT,  /* Offload TC infrastructure */
> > NETIF_F_HW_ESP_BIT, /* Hardware ESP transformation offload 
> > */
> > NETIF_F_HW_ESP_TX_CSUM_BIT, /* ESP with TX checksum offload */
> > +   NETIF_F_TUNNEL_OFFLOAD_BIT, /* Tunnel offloads */
> 
> "Tunnel offload" is very broad. Could we be more specific, e.g. "RSS
> tunnel offload" or such? NETIF_F_HW_TUNNEL_RSS?

Yeah, "tunnel offload" is too broad. But RSS isn't correct here, since
that's not the only thing that devices do with that feature.

Maybe "udp tunnel rx port" instead? Although, as Hannes pointed out
yesterday, we're not really sure that drivers/devices will only use it
for RX purposes either.


> > --- a/net/core/ethtool.c
> > +++ b/net/core/ethtool.c
> > @@ -106,6 +106,7 @@ static const char 
> > netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
> > [NETIF_F_HW_TC_BIT] ="hw-tc-offload",
> > [NETIF_F_HW_ESP_BIT] =   "esp-hw-offload",
> > [NETIF_F_HW_ESP_TX_CSUM_BIT] =   "esp-tx-csum-hw-offload",
> > +   [NETIF_F_TUNNEL_OFFLOAD_BIT] =   "tunnel-offload",
> >  };
> 
> And here, too. "rss-tunnel-offload"?

Yep, I'll update all that when we figure out a reasonable name.


Another thing I was thinking about would be to modify ethtool to show
these UDP tunneling features as a hierarchy (like we already have for
tx-checksumming). Both for this new feature and the existing
tx-udp_tnl-*.


Thanks for the comments,

-- 
Sabrina

Re: [PATCH 0/2] net: phy: dp83867: workaround incorrect RX_CTRL pin strap

[Andrew Lunn]

On Tue, Jul 04, 2017 at 04:23:22PM +0530, Sekhar Nori wrote:
> Hi,
> 
> This patch series adds workaround for incorrect RX_CTRL pin strap
> setting that can be found on some TI boards.

Hi Sekhar

Do you plan to post some DT patches to make use of this? It would be
good to seem them as well.

 Thanks
Andrew

Re: [PATCH 1/1] net sched: Added the TC_LINKLAYER_CUSTOM linklayer type

[Robert McCabe]

> You dump stab->data to user. How is this related to TC_LINKLAYER_CUSTOM
> and howcome this "is to support user-space modification of the qdisc
> stab" as your description says? I'm confused...

I have a related patch for iproute2 where the "custom" link-layer is
used to allow
user modification of the qdisc stab.  Dumping stab->data to the user
is used in the
iproute2 patch to show the current size translation table.

[PATCH][-next] net: macb: remove extraneous return when MACB_EXT_DESC is defined

[Colin King]

From: Colin Ian King 

When macro MACB_EXT_DESC is defined we end up with two identical
return statements and just one is sufficient. Remove the extra
return.

Detected by CoverityScan, CID#1449361 ("Structurally dead code")

Signed-off-by: Colin Ian King 
---
 drivers/net/ethernet/cadence/macb_main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/cadence/macb_main.c 
b/drivers/net/ethernet/cadence/macb_main.c
index 41e5711544fc..e69ebdd65658 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -146,7 +146,6 @@ static unsigned int macb_adj_dma_desc_idx(struct macb *bp, 
unsigned int desc_idx
default:
break;
}
-   return desc_idx;
 #endif
return desc_idx;
 }
-- 
2.11.0

[PATCH][bpf-next] bpf: add missing break in for the TCP_BPF_SNDCWND_CLAMP case

[Colin King]

From: Colin Ian King 

There appears to be a missing break in the TCP_BPF_SNDCWND_CLAMP case.
Currently the non-error path where val is greater than zero falls through
to the default case that sets the error return to -EINVAL. Add in
the missing break.

Detected by CoverityScan, CID#1449376 ("Missing break in switch")

Fixes: 13bf96411ad2 ("bpf: Adds support for setting sndcwnd clamp")
Signed-off-by: Colin Ian King 
---
 net/core/filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 94169572d002..c7f737058d89 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2867,6 +2867,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, 
bpf_sock,
tp->snd_cwnd_clamp = val;
tp->snd_ssthresh = val;
}
+   break;
default:
ret = -EINVAL;
}
-- 
2.11.0

Re: [PATCH][bpf-next] bpf: add missing break in for the TCP_BPF_SNDCWND_CLAMP case

[Daniel Borkmann]

[ +Lawrence ]

On 07/04/2017 05:21 PM, Colin King wrote:

From: Colin Ian King 

There appears to be a missing break in the TCP_BPF_SNDCWND_CLAMP case.
Currently the non-error path where val is greater than zero falls through
to the default case that sets the error return to -EINVAL. Add in
the missing break.

Detected by CoverityScan, CID#1449376 ("Missing break in switch")

Fixes: 13bf96411ad2 ("bpf: Adds support for setting sndcwnd clamp")
Signed-off-by: Colin Ian King 


Acked-by: Daniel Borkmann 


---
  net/core/filter.c | 1 +
  1 file changed, 1 insertion(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 94169572d002..c7f737058d89 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2867,6 +2867,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, 
bpf_sock,
tp->snd_cwnd_clamp = val;
tp->snd_ssthresh = val;
}
+   break;
default:
ret = -EINVAL;
}

Re: [PATCH 1/1] net sched: Added the TC_LINKLAYER_CUSTOM linklayer type

[Jiri Pirko]

Tue, Jul 04, 2017 at 04:49:24PM CEST, robert.mcc...@rockwellcollins.com wrote:
>> You dump stab->data to user. How is this related to TC_LINKLAYER_CUSTOM
>> and howcome this "is to support user-space modification of the qdisc
>> stab" as your description says? I'm confused...
>
>I have a related patch for iproute2 where the "custom" link-layer is
>used to allow
>user modification of the qdisc stab.  Dumping stab->data to the user
>is used in the
>iproute2 patch to show the current size translation table.

Even so, the kernel patch you sent does not make any sense. Introduces
TC_LINKLAYER_CUSTOM but does not use it.

Re: [PATCH 1/1] net sched: Added the TC_LINKLAYER_CUSTOM linklayer type

[Jiri Pirko]

Tue, Jul 04, 2017 at 05:34:50PM CEST, j...@resnulli.us wrote:
>Tue, Jul 04, 2017 at 04:49:24PM CEST, robert.mcc...@rockwellcollins.com wrote:
>>> You dump stab->data to user. How is this related to TC_LINKLAYER_CUSTOM
>>> and howcome this "is to support user-space modification of the qdisc
>>> stab" as your description says? I'm confused...
>>
>>I have a related patch for iproute2 where the "custom" link-layer is
>>used to allow
>>user modification of the qdisc stab.  Dumping stab->data to the user
>>is used in the
>>iproute2 patch to show the current size translation table.
>
>Even so, the kernel patch you sent does not make any sense. Introduces
>TC_LINKLAYER_CUSTOM but does not use it.

Also, please make you email working. Says to me:

** Address not found **

Your message wasn't delivered to mcc...@rockwellcollins.com because the address 
couldn't be found. Check for typos or unnecessary spaces and try again.

This is annoying.

Re: WARN_ON_ONCE(work > weight) in napi_poll()

[Andrey Ryabinin]

On 07/04/2017 04:49 PM, Kalle Valo wrote:
> Andrey Ryabinin  writes:
> 
>> I occasionally hit WARN_ON_ONCE(work > weight); in napi_poll() on a
>> laptop with ath10k card.
>>
>>
>> [37207.593370] [ cut here ]
>> [37207.593380] WARNING: CPU: 0 PID: 7 at ../net/core/dev.c:5274
>> net_rx_action+0x258/0x360
>> [37207.593381] Modules linked in: snd_hda_codec_realtek snd_soc_skl
>> snd_hda_codec_generic snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp
>> snd_hda_ext_core snd_soc_sst_match snd_soc_core rtsx_pci_sdmmc
>> mmc_core snd_pcm_dmaengine x86_pkg_temp_thermal snd_hda_intel uvcvideo
>> kvm_intel videobuf2_vmalloc kvm snd_hda_codec snd_hwdep btusb
>> videobuf2_memops btintel snd_hda_core videobuf2_v4l2 bluetooth
>> irqbypass snd_pcm videobuf2_core crc32c_intel videodev mei_me mei
>> rtsx_pci intel_lpss_pci intel_lpss_acpi intel_vbtn intel_lpss mfd_core
>> tpm_tis intel_hid tpm_tis_core tpm efivarfs
>> [37207.593430] CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 4.11.7 #28
>> [37207.593432] Hardware name: Dell Inc. XPS 13 9360/0839Y6, BIOS 1.3.5 
>> 05/08/2017
> 
> What firmware and hardware versions exactly? The dmesg output when
> ath10k loads is preferred. As you are using XPS 13 I'm guessing it's one
> of QCA6174 family.
> 

Yes it's qca6174.

$ dmesg |grep ath10
[0.624828] ath10k_pci :3a:00.0: enabling device ( -> 0002)
[0.626370] ath10k_pci :3a:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 
reset_mode 0
[0.837862] ath10k_pci :3a:00.0: qca6174 hw3.2 target 0x0503 chip_id 
0x00340aff sub 1a56:1535
[0.837863] ath10k_pci :3a:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 
0 testmode 0
[0.838388] ath10k_pci :3a:00.0: firmware ver 
WLAN.RM.2.0-00180-QCARMSWPZ-1 api 4 features wowlan,ignore-otp,no-4addr-pad 
crc32 75dee6c5
[0.900606] ath10k_pci :3a:00.0: board_file api 2 bmi_id N/A crc32 
19644295
[3.020681] ath10k_pci :3a:00.0: htt-ver 3.26 wmi-op 4 htt-op 3 cal otp 
max-sta 32 raw 0 hwcrypto 1
[9.574087] ath10k_pci :3a:00.0 wlp58s0: renamed from wlan0

[PATCH 1/1 V2] tc: custom qdisc pkt size translation table

[McCabe, Robert J]

Added the "custom" linklayer qdisc stab option.
Allows the user to specify the pkt size translation
parameters from stdin.
Example:
   tc qdisc add ... stab tsize 8 linklayer custom htb
  Custom size table:
  InputSizeStart -> IntputSizeEnd: OutputSize
  0  -> 511  : 600
  512-> 1023 : 1200
  1024   -> 1535 : 1800
  1536   -> 2047 : 2400
  2048   -> 2559 : 3000

Signed-off-by: McCabe, Robert J 
---

V1: Sent to netdev for review
V2: Cleaned up commit message and set common_size_table to NULL
after free

 include/linux/pkt_sched.h |  1 +
 tc/tc_core.c  | 47 +++
 tc/tc_core.h  |  2 +-
 tc/tc_stab.c  | 20 +---
 tc/tc_util.c  |  5 +
 5 files changed, 63 insertions(+), 12 deletions(-)

diff --git a/include/linux/pkt_sched.h b/include/linux/pkt_sched.h
index 099bf55..289bb81 100644
--- a/include/linux/pkt_sched.h
+++ b/include/linux/pkt_sched.h
@@ -82,6 +82,7 @@ enum tc_link_layer {
TC_LINKLAYER_UNAWARE, /* Indicate unaware old iproute2 util */
TC_LINKLAYER_ETHERNET,
TC_LINKLAYER_ATM,
+   TC_LINKLAYER_CUSTOM,
 };
 #define TC_LINKLAYER_MASK 0x0F /* limit use to lower 4 bits */

diff --git a/tc/tc_core.c b/tc/tc_core.c
index 821b741..f02f612 100644
--- a/tc/tc_core.c
+++ b/tc/tc_core.c
@@ -21,6 +21,7 @@
 #include 
 #include 
 #include 
+#include 

 #include "tc_core.h"
 #include 
@@ -28,6 +29,13 @@
 static double tick_in_usec = 1;
 static double clock_factor = 1;

+struct size_table_entry {
+   unsigned int input_size_boundary_start;
+   unsigned int output_size_bytes;
+};
+
+static struct size_table_entry* custom_size_table = NULL;
+static int num_size_table_entries = 0;
 int tc_core_time2big(unsigned int time)
 {
__u64 t = time;
@@ -89,6 +97,20 @@ static unsigned int tc_align_to_atm(unsigned int size)
return linksize;
 }

+static unsigned int tc_align_to_custom(unsigned int size)
+{
+   int i;
+
+   assert(custom_size_table != NULL);
+   for(i = num_size_table_entries -1; i >= 0 ; --i) {
+   if(custom_size_table[i].input_size_boundary_start < size) {
+   /* found it */
+   return custom_size_table[i].output_size_bytes;
+   }
+   }
+   return 0;
+}
+
 static unsigned int tc_adjust_size(unsigned int sz, unsigned int mpu, enum 
link_layer linklayer)
 {
if (sz < mpu)
@@ -97,6 +119,8 @@ static unsigned int tc_adjust_size(unsigned int sz, unsigned 
int mpu, enum link_
switch (linklayer) {
case LINKLAYER_ATM:
return tc_align_to_atm(sz);
+   case LINKLAYER_CUSTOM:
+   return tc_align_to_custom(sz);
case LINKLAYER_ETHERNET:
default:
/* No size adjustments on Ethernet */
@@ -185,6 +209,24 @@ int tc_calc_size_table(struct tc_sizespec *s, __u16 **stab)
if (!*stab)
return -1;

+   if(LINKLAYER_CUSTOM == linklayer) {
+custom_size_table = malloc(sizeof(struct size_table_entry)* 
s->tsize);
+if(!custom_size_table)
+ return -1;
+num_size_table_entries = s->tsize;
+
+printf("Custom size table:\n");
+printf("InputSizeStart -> IntputSizeEnd: OutputSize\n");
+for(i = 0; i <= s->tsize - 1; ++i) {
+ printf("%-14d -> %-13d: ", i << s->cell_log, ((i+1) 
<< s->cell_log) - 1);
+ if(!scanf("%u", 
&custom_size_table[i].output_size_bytes)) {
+   fprintf(stderr, "Invalid custom stab 
table entry!\n");
+   return -1;
+ }
+ custom_size_table[i].input_size_boundary_start = i << 
s->cell_log;
+}
+   }
+
 again:
for (i = s->tsize - 1; i >= 0; i--) {
sz = tc_adjust_size((i + 1) << s->cell_log, s->mpu, linklayer);
@@ -196,6 +238,11 @@ again:
}

s->cell_align = -1; /* Due to the sz calc */
+   if(custom_size_table) {
+free(custom_size_table);
+custom_size_table = NULL;
+num_size_table_entries = 0;
+   }
return 0;
 }

diff --git a/tc/tc_core.h b/tc/tc_core.h
index 8a63b79..8e97222 100644
--- a/tc/tc_core.h
+++ b/tc/tc_core.h
@@ -10,9 +10,9 @@ enum link_layer {
LINKLAYER_UNSPEC,
LINKLAYER_ETHERNET,
LINKLAYER_ATM,
+   LINKLAYER_CUSTOM,
 };

-
 int  tc_core_time2big(unsigned time);
 unsigned tc_core_time2tick(unsigned time);
 unsigned tc_core_tick2time(unsigned tick);
diff --git a/tc/tc_stab.c b/tc/tc_stab.c
index 1a0a3e3..a468a70 100644
--- a/tc/tc_stab.c
+++ b/tc/tc_stab.c
@@ -37,7 +37,9 @@ static void stab_help(void)
"   tsize   

Re: [PATCH] net: axienet: add of_phy_connect call for XAE_PHY_TYPE_MII case

[Florian Fainelli]

On July 2, 2017 3:19:14 AM PDT, Alvaro Gamez Machado  
wrote:
>On Fri, Jun 30, 2017 at 10:30:38AM -0700, Florian Fainelli wrote:
>> On 06/30/2017 02:25 AM, Alvaro Gamez Machado wrote:
>> >if (lp->phy_node) {
>> > -  if (lp->phy_type == XAE_PHY_TYPE_GMII) {
>> > +  if (lp->phy_type == XAE_PHY_TYPE_MII) {
>> > +  phydev = of_phy_connect(lp->ndev, lp->phy_node,
>> > +  axienet_adjust_link, 0,
>> > +  PHY_INTERFACE_MODE_MII);
>> > +  } else if (lp->phy_type == XAE_PHY_TYPE_GMII) {
>> >phydev = of_phy_connect(lp->ndev, lp->phy_node,
>> >axienet_adjust_link, 0,
>> >PHY_INTERFACE_MODE_GMII);
>> 
>> Seems like this could be simplified even further if the values of
>> lp->phy_type directly mapped to those of phy_interface_t.
>
>Sadly, that's not the case. PHY_INTERFACE_MODE_* belong to a enum of
>twenty
>different values, of which only _MII and _GMII overlap with XAW_PHY_*
>values, but XAE_PHY_TYPE_RGMII_2_0 doesn't match
>PHY_INTERFACE_MODE_RGMII_ID.

There are four different rgmii types to account for rx or tx delay, is not 
there one that really matches? If the driver is using of_get_phy_mode() to 
retrieve the standard 'phy-mode' / 'phy-connection-type' values then this 
internal representation is not needed anymore.

-- 
Florian

Re: [PATCH net 0/3] Bugfixs for hns ethernet driver

[Florian Fainelli]

On 04/07/2017 03:47, Lin Yun Sheng wrote:
> This patchset fix skb uesd after used, C45 op code and
> Tx description filling issues in hns driver.

Since these are fixes, can you include proper Fixes: tag so it is easier
for -stable maintainers to backport such changes where appropriate?
--
Florian

Re: [PATCH 1/1] net sched: Added the TC_LINKLAYER_CUSTOM linklayer type

[Robert McCabe]

>>Even so, the kernel patch you sent does not make any sense. Introduces
>>TC_LINKLAYER_CUSTOM but does not use it.

I needed to add this to the tc_link_layer enum in my iproute2 patch
(https://patchwork.ozlabs.org/patch/784165/)

enum tc_link_layer {
  TC_LINKLAYER_UNAWARE, /* Indicate unaware old iproute2 util */
  TC_LINKLAYER_ETHERNET,
  TC_LINKLAYER_ATM,
   + TC_LINKLAYER_CUSTOM,
 };

I originally wasn't aware that this file was shared with the kernel --
my original patch received the comment from Eric Dumazet

You can not do this : This file is coming from the kernel
 ( include/uapi/linux/pkt_sched.h )

So I opted to make the corresponding change to the pkt_sched.h file in
the kernel.
But looking at it further, I am confused as to why this tc_link_layer even needs
to exist in the kernel anyway,  It is only used in net/sched for calculating the
size (via stab) and rate (via rtab) translations; however, these
translations are
already specified with in the form of the stab and rtab themselves (these are
calculated in userspace).

I think -- in a perfect world -- the tc_link_layer (and the associated
tc_ratespec.linklayer and  tc_sizespec.linklayer) should be removed
from the kernel,
but I'm not sure of the compatibility implications of this ...
Do you have any suggestions?

>
> Also, please make you email working. Says to me:
>
> ** Address not found **
>
> Your message wasn't delivered to mcc...@rockwellcollins.com because the 
> address couldn't be found. Check for typos or unnecessary spaces and try 
> again.
>
> This is annoying.

I think I fixed it -- was mis-configuration in my .gitconfig (sorry,
I'm still new at this).

[net-next:master 443/444] af_mpls.c:undefined reference to `rtm_ipv4_policy'

[kbuild test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 
master
head:   bf72acefebb459af3c805a386cd7e5456e3ad6ee
commit: 397fc9e5cefee0c33b86811fbddb0decb7288c52 [443/444] mpls: route get 
support
config: i386-randconfig-x0-07042231 (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
reproduce:
git checkout 397fc9e5cefee0c33b86811fbddb0decb7288c52
# save the attached .config to linux build tree
make ARCH=i386 

All errors (new ones prefixed by >>):

   net/built-in.o: In function `mpls_getroute':
>> af_mpls.c:(.text+0x11589d): undefined reference to `rtm_ipv4_policy'

---
0-DAY kernel test infrastructureOpen Source Technology Center
https://lists.01.org/pipermail/kbuild-all   Intel Corporation


.config.gz
Description: application/gzip

Re: 'skb' buffer address information leakage

[Stephen Hemminger]

On Tue, 4 Jul 2017 13:12:18 +0800
Dison River  wrote:

> Hi all:
> I'd found several address leaks of "skb" buffer.When i have a
> arbitrary address write vulnerability in kernel(enabled kASLR),I can
> use skb's address find sk_destruct's address and overwrite it. And
> then,invoke close(sock_fd) function can trigger the
> shellcode(sk_destruct func).
> 
> In kernel 4.12-rc7
> drivers/net/irda/vlsi_ir.c:326   seq_printf(seq, "skb=%p
> data=%p hw=%p\n", rd->skb, rd->buf, rd->hw);
> drivers/net/ethernet/netronome/nfp/nfp_net_debugfs.c:167
>  seq_printf(file, " frag=%p", skb);
> drivers/net/wireless/ath/wil6210/debugfs.c:926   seq_printf(s,
> "  SKB = 0x%p\n", skb);
> 
> Thanks.

Debugfs support is optional with Netronome. If concerned about security,
then it should be disabled.

The WIIL6210 driver debugfs has other worse address leaks.
The whole debugfs support in this driver should be made optional
(or removed).

The VLSI /oroc interface likewise should just be removed (or made
optional). Most distributions do not build IRDA anymore anyway.

Re: [PATCH 1/1 V2] tc: custom qdisc pkt size translation table

[Stephen Hemminger]

On Tue,  4 Jul 2017 10:50:58 -0500
"McCabe, Robert J"  wrote:

> Added the "custom" linklayer qdisc stab option.
> Allows the user to specify the pkt size translation
> parameters from stdin.
> Example:
>tc qdisc add ... stab tsize 8 linklayer custom htb
>   Custom size table:
>   InputSizeStart -> IntputSizeEnd: OutputSize
>   0  -> 511  : 600
>   512-> 1023 : 1200
>   1024   -> 1535 : 1800
>   1536   -> 2047 : 2400
>   2048   -> 2559 : 3000
> 
> Signed-off-by: McCabe, Robert J 

LINKLAYER_CUSTOM was not accepted into the upstream net-next kernel.
Please resubmit after the kernel portion is accepted into net-next.

Re: [PATCH][bpf-next] bpf: add missing break in for the TCP_BPF_SNDCWND_CLAMP case

[Lawrence Brakmo]

On 7/4/17, 8:26 AM, "netdev-ow...@vger.kernel.org on behalf of Daniel Borkmann" 
 wrote:

[ +Lawrence ]

On 07/04/2017 05:21 PM, Colin King wrote:
> From: Colin Ian King 
>
> There appears to be a missing break in the TCP_BPF_SNDCWND_CLAMP case.
> Currently the non-error path where val is greater than zero falls through
> to the default case that sets the error return to -EINVAL. Add in
> the missing break.
>
> Detected by CoverityScan, CID#1449376 ("Missing break in switch")
>
> Fixes: 13bf96411ad2 ("bpf: Adds support for setting sndcwnd clamp")
> Signed-off-by: Colin Ian King 

Acked-by: Daniel Borkmann dan...@iogearbox.net
Acked-by: Lawrence Brakmo 

> ---
>   net/core/filter.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 94169572d002..c7f737058d89 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -2867,6 +2867,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern 
*, bpf_sock,
>   tp->snd_cwnd_clamp = val;
>   tp->snd_ssthresh = val;
>   }
> + break;
>   default:
>   ret = -EINVAL;
>   }
>

[PATCH 0/2] bring UP loopback device at initialziation

[Mahesh Bandewar]

From: Mahesh Bandewar 

In almost every scenario the loopback device is brought UP after
initialization. So there is no point of bringing up the device in
DOWN state followed by device UP operation. This change exposed
another issue of fib-trie initialization which is corrected in the 
first path.

Mahesh Bandewar (2):
  ipv4: initialize fib_trie prior to register_netdev_notifier call.
  loopback: bringup 'lo' by default at initialization

 drivers/net/loopback.c  | 6 ++
 net/ipv4/fib_frontend.c | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

-- 
2.13.2.725.g09c95d1e9-goog

[PATCH 2/2] loopback: bringup 'lo' by default at initialization

[Mahesh Bandewar]

From: Mahesh Bandewar 

loopback devices are always brought up right after its initialization
including the case of network namespace creation. e.g.

ip netns add foo
ip -netns foo link set lo up

This patch will eliminate the need to do that separately and would bring
it up as part of the loopback initialization.

Signed-off-by: Mahesh Bandewar 
---
 drivers/net/loopback.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 30612497643c..3216977935d1 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -217,6 +217,12 @@ static __net_init int loopback_net_init(struct net *net)
 
BUG_ON(dev->ifindex != LOOPBACK_IFINDEX);
net->loopback_dev = dev;
+
+   /* Set the loopback device UP */
+   rtnl_lock();
+   dev_open(net->loopback_dev);
+   rtnl_unlock();
+
return 0;
 
 out_free_netdev:
-- 
2.13.2.725.g09c95d1e9-goog

[PATCH 1/2] ipv4: initialize fib_trie prior to register_netdev_notifier call.

[Mahesh Bandewar]

From: Mahesh Bandewar 

Net stack initialization currently initializes fib-trie after the
first call to netdevice_notifier() call. It does not cause any problem
since there are no devices UP at this moment, but trying to bring 'lo'
UP at initialization would make this assumption wrong. However changing
order solves the issue.

Fixes following crash

[8.647095] BUG: unable to handle kernel NULL pointer dereference at 
0014
[8.654836] IP: kmem_cache_alloc+0xcf/0x1c0
[8.658966] PGD 0
[8.658967] P4D 0
[8.660953]
[8.664406] Oops:  [#1] SMP
[8.667505] Modules linked in:
[8.670519] CPU: 4 PID: 1 Comm: swapper/0 Not tainted 4.12.0-smp-DEV #34
[8.677138] Hardware name: Intel Grantley,Wellsburg/Ixion_IT_15, BIOS 2.60.0 
06/03/2016
[8.685043] task: 8f26b2b00dc0 task.stack: 9b1500014000
[8.690891] RIP: 0010:kmem_cache_alloc+0xcf/0x1c0
[8.695535] RSP: :9b1500017c28 EFLAGS: 00010246
[8.700696] RAX: 96ed4f47 RBX:  RCX: 0200
[8.707743] RDX: 0400 RSI: 014000c0 RDI: 
[8.714791] RBP: 9b1500017c58 R08: 0001 R09: 
[8.721837] R10:  R11:  R12: 014000c0
[8.728886] R13: 014000c0 R14:  R15: 
[8.735932] FS:  () GS:8f26bf50() 
knlGS:
[8.743925] CS:  0010 DS:  ES:  CR0: 80050033
[8.749599] CR2: 0014 CR3: 001d05609000 CR4: 001406e0
[8.756648] Call Trace:
[8.759061]  ? alternate_node_alloc+0x76/0xa0
[8.763364]  fib_table_insert+0x1b7/0x4b0
[8.767323]  fib_magic.isra.17+0xea/0x120
[8.771283]  fib_add_ifaddr+0x7b/0x190
[8.774983]  fib_netdev_event+0xc0/0x130
[8.778857]  register_netdevice_notifier+0x1c1/0x1d0
[8.783761]  ip_fib_init+0x72/0x85
[8.787120]  ip_rt_init+0x187/0x1e9
[8.790564]  ip_init+0xe/0x1a
[8.793494]  inet_init+0x171/0x26c
[8.796851]  ? ipv4_offload_init+0x66/0x66
[8.800896]  do_one_initcall+0x43/0x160
[8.804685]  kernel_init_freeable+0x191/0x219
[8.808987]  ? rest_init+0x80/0x80
[8.812343]  kernel_init+0xe/0x150
[8.815702]  ret_from_fork+0x22/0x30
[8.819229] Code: f6 46 23 04 74 86 4c 89 f7 e8 ae 45 01 00 49 89 c7 4d 85 
ff 0f 85 7b ff ff ff 31 db eb 08 4c 89 ff e8 16 47 01 00 48 8b 44 24 38 <45> 8b 
6e 14 4d 63 76 74 48 89 04 24 0f 1f 44 00 00 48 83 c4 08
[8.837882] RIP: kmem_cache_alloc+0xcf/0x1c0 RSP: 9b1500017c28
[8.843986] CR2: 0014
[8.847288] ---[ end trace 8fc60994c8a367cb ]---
[8.851847] Kernel panic - not syncing: Fatal exception
[8.857035] Rebooting in 10 seconds..

Signed-off-by: Mahesh Bandewar 
---
 net/ipv4/fib_frontend.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e678fa892dd..ca22ca47019a 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1338,9 +1338,9 @@ void __init ip_fib_init(void)
rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
 
+   fib_trie_init();
+
register_pernet_subsys(&fib_net_ops);
register_netdevice_notifier(&fib_netdev_notifier);
register_inetaddr_notifier(&fib_inetaddr_notifier);
-
-   fib_trie_init();
 }
-- 
2.13.2.725.g09c95d1e9-goog

Re: [PATCH v3 net-next 00/12] bpf: rewrite value tracking in verifier

[Edward Cree]

On 30/06/17 19:15, Alexei Starovoitov wrote:
> On 6/30/17 9:44 AM, Edward Cree wrote:
>> I haven't measured the test_progs ones, because I *still* haven't gotten
>>  around to actually setting up a BPF toolchain (it doesn't help that I'm
>>  building everything on a test server that gets reimaged every night to
>>  run our nightly tests...).
>
> then you're missing a lot of tests then...
> installing llvm is trivial. On x86 there are plenty of pre-built
> packages that you can apt-get or yum.
> Dave had to compile llvm and gcc from source on sparc, so volatile test
> server isn't really an excuse to miss all these tests ;)
> especially for such large verifier change.
>
After two days' wrestling with clang's build system, I'm finally able to
 run test_progs, and all its tests pass as of the full patch series.
Here are the processed insn counts:

Program net-next  short  full
test_pkt_access   78 7979
test_xdp 386411   407
test_l4lb   6438   4154  4154
test_tcp_estats  435436   435
test_bpf_obj_id8  8 8
test_pkt_md_access41 4242

"short" is the first 3 patches plus the 'roll back ptr&const' patch I
 posted on Friday.  "full" is the full 12-patch series.  "Program" is
 the function in test_progs.c.
I don't know why test_l4lb has to process _fewer_ insns with my patches;
 if anything I'm worrying that I may be incorrectly pruning branches.
(I've spotted a possible bug in that I'm not looking at 'id' which,
 although it doesn't have to match, if two regs in the old state had the
 same id as each other, then those regs in the new state have to have
 the same id as each other too.)
Also interesting is that going from "short" to "full" only decreases the
 counts, suggesting that the ptr&const and full negative/positive
 tracking isn't (at least for these test cases) costly.

-Ed

Re: [PATCH net 0/3] nfp: port enumeration change and FW ABI adjustment

[Jakub Kicinski]

On Tue, 04 Jul 2017 03:29:49 -0700 (PDT), David Miller wrote:
> From: Jakub Kicinski 
> Date: Tue,  4 Jul 2017 02:27:18 -0700
> 
> > This set changes the way ports are numbered internally to avoid MAC address
> > changes and invalid link information when breakout is configured.  Second
> > patch gets rid of old way of looking up MAC addresses in device information
> > which caused all this confusion.
> > 
> > Patch 3 is a small adjustment to the new FW ABI version we introduced in
> > this release cycle.
> > 
> > 
> > To clarify these are intended for 4.13, naturally.  
> 
> net-next is closed, and it looks like these are not really bug fixes
> but a behavior adjustment and therefore more like a new feature.

Ah, silly me, I had these ready on Friday but didn't want to participate
in the just-before-the-merge-window rush :(

Could you be pursued to take patch 3?  Without it our current Flower
firmware does not work with the 5.x ABI, if we get a kernel released in
this state we will have to bump the ABI again, effectively making the
4.13 Flower offload unusable :(

Patch 1 fixes ethtool dumping and configuring wrong ports.  I had a
report from someone using a 2x40 card where one port was broken out to
4x10 and ethtool was swapping info on the 40G port and one of the 10G
ports.  I didn't notice this in testing, because I was testing with two
NFPs back to back, so the port swap sort of cancelled itself out.  I
should've made it clearer in the commit message that the patch
effectively fixes the association between management FW idea of ports
and the netdevs.  This is lower priority than patch 3, though.

Patch 2 can be dropped, I tossed it in unnecessarily.

[PATCH iproute2 1/1] Add new man page for tc actions.

[Lucas Bates]

This page is to highlight all operations and options that are
applicable to all tc actions.

Signed-off-by: Lucas Bates 
Signed-off-by: Jamal Hadi Salim 
---
 man/man8/tc-actions.8 | 221 ++
 1 file changed, 221 insertions(+)
 create mode 100644 man/man8/tc-actions.8

diff --git a/man/man8/tc-actions.8 b/man/man8/tc-actions.8
new file mode 100644
index 000..51f43af
--- /dev/null
+++ b/man/man8/tc-actions.8
@@ -0,0 +1,221 @@
+.TH "actions in tc" 8 "4 Jul 2017" "iproute2" "Linux"
+
+.SH NAME
+actions \- independently defined actions in tc
+.SH SYNOPSIS
+.B tc
+[
+.I TC_OPTIONS
+]
+.B actions
+.BR add " | " change " | " replace
+.I ACTSPEC
+
+.B tc
+[
+.I TC_OPTIONS
+]
+.B actions
+.BR get " | " delete
+.I ACTISPEC
+
+.B tc
+[
+.I TC_OPTIONS
+]
+.B actions flush
+.I ACTNAMESPEC
+
+.B tc
+[
+.I TC_OPTIONS
+]
+.B actions
+.BR ls " | " list
+.I ACTNAMESPEC
+
+.in +8
+.I ACTSPEC
+:=
+.B action
+.I ACTDETAIL
+[
+.I INDEXSPEC
+] [
+.I COOKIESPEC
+] [
+.I CONTROL
+]
+
+.I ACTISPEC
+:=
+.I ACTNAMESPEC INDEXSPEC
+
+.I ACTNAMESPEC
+:=
+.B action
+ACTNAME
+
+.I INDEXSPEC
+:=
+.BI index " INDEX"
+
+.I COOKIESPEC
+:=
+.BI cookie " COOKIE"
+
+.I ACTDETAIL
+:=
+.I ACTNAME ACTPARAMS
+
+.I ACTNAME
+may be any valid action type: gact, mirred, bpf, connmark, csum, police, etc.
+
+.I ACTPARAMS
+are the action-specific parameters; see the man page for the specific action
+type to be used for details.
+
+.I CONTROL
+:= {
+.IR reclassify " | " pipe " | " drop " | " continue " | " ok
+}
+
+.I TC_OPTIONS
+These are the options that are specific to
+.B tc
+and not only the options. Refer to
+.BR tc(8)
+for more information.
+.in
+
+.SH DESCRIPTION
+
+The
+.B actions
+object in
+.B tc
+allows a user to define actions independently of a classifier (filter). These
+actions can then be assigned to one or more filters, with any
+packets matching the classifier's criteria having that action performed
+on them.
+
+Each action type (mirred, police, etc.) will have its own table to store
+all created actions.
+
+.SH OPERATIONS
+.TP
+.B add
+Create a new action in that action's table.
+
+.TP
+.B change
+.TQ
+.B replace
+Make modifications to an existing action.
+.TP
+.B get
+Display the action with the specified index value. When combined with the
+.B -s
+option for
+.BR tc ","
+display the statistics for that action.
+.TP
+.B delete
+Delete the action with the specified index value. If the action is already
+associated with a classifier, it does not delete the classifier.
+.TP
+.B ls
+.TQ
+.B list
+List all the actions in the specified table. When combined with the
+.B -s
+option for
+.BR tc ","
+display the statistics for all actions in the specified table.
+.TP
+.B flush
+Delete all actions stored in the specified table.
+
+.SH ACTION OPTIONS
+Note that these options are available to all action types.
+.TP
+.BI index " INDEX"
+Specify the table index value of an action.
+.I INDEX
+is a 32-bit value that is unique to the specific type of action referenced.
+
+.RS
+For
+.BR add ", " change ", and"
+.B replace
+operations, the index is
+.BR optional.
+When adding a new action,
+specifying an index value will assign the action to that index unless that
+index value has already been assigned. Omitting the index value for an add
+operation will cause the kernel to assign a value to the new action.
+.RE
+
+.RS
+For
+.BR get " and " delete
+operations, the index is
+.B required
+to identify the specific action to be displayed or deleted.
+.RE
+
+.TP
+.BI cookie " COOKIE"
+In addition to the specific action, mark the matching packet with the value
+specified by
+.IR COOKIE "."
+The
+.I COOKIE
+is a 128-bit value that will not be interpreted by the kernel whatsoever.
+As such, it can be used as a correlating value for maintaining user state.
+The value to be stored is completely arbitrary and does not require a specific
+format. It is stored inside the action structure itself.
+
+.TP
+.I CONTROL
+The
+.I CONTROL
+indicates how
+.B tc
+should proceed after executing the action. Any of the following are valid:
+.RS
+.TP
+.B reclassify
+Restart the classifiction by jumping back to the first filter attached to
+the action's parent.
+.TP
+.B pipe
+Continue with the next action. This is the default control.
+.TP
+.B drop
+Drop the packed without running any further actions.
+.TP
+.B continue
+Continue the classification with the next filter.
+.TP
+.B pass
+Return to the calling qdisc for packet processing, and end classification of
+this packet.
+.RE
+
+.SH SEE ALSO
+.BR tc (8),
+.BR tc-bpf (8),
+.BR tc-connmark (8),
+.BR tc-csum (8),
+.BR tc-ife (8),
+.BR tc-mirred (8),
+.BR tc-nat (8),
+.BR tc-pedit (8),
+.BR tc-police (8),
+.BR tc-simple (8),
+.BR tc-skbedit (8),
+.BR tc-skbmod (8),
+.BR tc-tunnel_key (8),
+.BR tc-vlan (8),
+.BR tc-xt (8)
--
2.7.4

[PATCH net-next] bpf: fix return in load_bpf_file

[Lawrence Brakmo]

The function load_bpf_file ignores the return value of
load_and_attach(), so even if load_and_attach() returns an error,
load_bpf_file() will return 0.

Now, load_bpf_file() can call load_and_attach() multiple times and some
can succeed and some could fail. I think the correct behavor is to
return error on the first failed load_and_attach().
---
 samples/bpf/bpf_load.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
index a4be7cf..899f403 100644
--- a/samples/bpf/bpf_load.c
+++ b/samples/bpf/bpf_load.c
@@ -567,8 +567,12 @@ static int do_load_bpf_file(const char *path, fixup_map_cb 
fixup_map)
memcmp(shname, "perf_event", 10) == 0 ||
memcmp(shname, "socket", 6) == 0 ||
memcmp(shname, "cgroup/", 7) == 0 ||
-   memcmp(shname, "sockops", 7) == 0)
-   load_and_attach(shname, data->d_buf, data->d_size);
+   memcmp(shname, "sockops", 7) == 0) {
+   ret = load_and_attach(shname, data->d_buf,
+ data->d_size);
+   if (ret != 0)
+   goto done;
+   }
}
 
ret = 0;
-- 
2.9.3