Re: [PATCH v2 net 2/2] net sched actions: decrement module refcount earlier

2017-04-18 Thread Cong Wang
On Tue, Apr 18, 2017 at 7:21 PM, Jamal Hadi Salim wrote: > Indeed. Allocate the cookie before init? That way, we fail early > and dont need to worry about restoring anything. No, a->act_cookie needs an action pointer first. ;) > In the case of a replace, do you really want to call tcf_hash_relea

Re: [PATCH net-next 1/2 v2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Cong Wang
On Tue, Apr 18, 2017 at 7:32 PM, Jamal Hadi Salim wrote: > On 17-04-18 09:49 PM, Eric Dumazet wrote: >> >> On Tue, 2017-04-18 at 21:14 -0400, Jamal Hadi Salim wrote: >>> >>> From: Jamal Hadi Salim >> >> >> So there is no more limit ? How user is supposed to size the buffer for >> recvmsg() ? >> >

Re: netlink: question about netlink testsuite

2017-04-18 Thread Cong Wang
Hello, On Tue, Apr 18, 2017 at 10:00 PM, Yasuhara, Hiroyuki wrote: > Hi, > > I'm looking for a testset about netlink function, > for example, making a lot of netlink sockets and > communicating with them in the testset. > > If anyone know such a testset, please give me the information. > libnl3

Re: [PATCH net-next 2/2] Add Jiri Pirko as TC subsystem co-maintainer

2017-04-18 Thread Jiri Pirko
Wed, Apr 19, 2017 at 03:24:00AM CEST, j...@mojatatu.com wrote: >From: Jamal Hadi Salim > >Signed-off-by: Jamal Hadi Salim Acked-by: Jiri Pirko

Re: [PATCH net-next 1/2] Add Cong Wang as TC subsystem co-maintainer

2017-04-18 Thread Cong Wang
On Tue, Apr 18, 2017 at 6:23 PM, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim > > Signed-off-by: Jamal Hadi Salim I am happy and honored to review net sched patches, Acked-by: Cong Wang Thanks.

RE: FEC on i.MX 7 transmit queue timeout

2017-04-18 Thread Stefan Agner
On 2017-04-18 22:28, Andy Duan wrote: > From: Stefan Agner Sent: Wednesday, April 19, 2017 1:02 PM >>To: Andy Duan >>Cc: fugang.d...@freescale.com; feste...@gmail.com; >>netdev@vger.kernel.org; netdev-ow...@vger.kernel.org >>Subject: Re: FEC on i.MX 7 transmit queue timeout >> >>Hi Andy, >> >>On

[PATCH ipsec-next] esp4/6: Fix GSO path for non-GSO SW-crypto packets

2017-04-18 Thread ilant
From: Ilan Tayari If esp*_offload module is loaded, outbound packets take the GSO code path, being encapsulated at layer 3, but encrypted in layer 2. validate_xmit_xfrm calls esp*_xmit for that. esp*_xmit was wrongfully detecting these packets as going through hardware crypto offload, while in f

Re: export pcie_flr and remove copies of it in drivers V2

2017-04-18 Thread Leon Romanovsky
On Tue, Apr 18, 2017 at 01:36:12PM -0500, Bjorn Helgaas wrote: > On Fri, Apr 14, 2017 at 09:11:24PM +0200, Christoph Hellwig wrote: > > Hi all, > > > > this exports the PCI layer pcie_flr helper, and removes various opencoded > > copies of it. > > > > Changes since V1: > > - rebase on top of the p

RE: FEC on i.MX 7 transmit queue timeout

2017-04-18 Thread Andy Duan
From: Stefan Agner Sent: Wednesday, April 19, 2017 1:02 PM >To: Andy Duan >Cc: fugang.d...@freescale.com; feste...@gmail.com; >netdev@vger.kernel.org; netdev-ow...@vger.kernel.org >Subject: Re: FEC on i.MX 7 transmit queue timeout > >Hi Andy, > >On 2017-04-18 19:24, Andy Duan wrote: >> On 2017年04

Re: [PATCH][net-next] esp6: fix incorrect null pointer check on xo

2017-04-18 Thread Steffen Klassert
On Tue, Apr 18, 2017 at 01:12:53PM -0400, David Miller wrote: > From: Colin King > Date: Tue, 18 Apr 2017 15:06:53 +0100 > > Trimming the CC: list down to something that actually makes > sense. > > > From: Colin Ian King > > > > The check for xo being null is incorrect, currently it is checkin

Re: question about size of sk_buff and skb_shared_info

2017-04-18 Thread Code Soldier1
On Tue, Apr 18, 2017 at 5:47 PM, Eric Dumazet wrote: > > For the last time, do not top post on netdev. Sorry about that. > > On Tue, 2017-04-18 at 17:15 -0700, Code Soldier1 wrote: >> I am not suggesting that we do not do cache alignment. That is >> required for performance. I have gone through t

pull request (net): ipsec 2017-04-19

2017-04-18 Thread Steffen Klassert
Two fixes for af_key: 1) Add a lock to key dump to prevent a NULL pointer dereference. From Yuejie Shi. 2) Fix slab-out-of-bounds in parse_ipsecrequests. From Herbert Xu. Please pull or let me know if there are problems. Thanks! The following changes since commit 75514b6654859e0130b51239

netlink: question about netlink testsuite

2017-04-18 Thread Yasuhara, Hiroyuki
Hi, I'm looking for a testset about netlink function, for example, making a lot of netlink sockets and communicating with them in the testset. If anyone know such a testset, please give me the information. Regards, Yasuhara

[PATCH 1/2] af_key: Add lock to key dump

2017-04-18 Thread Steffen Klassert
From: Yuejie Shi A dump may come in the middle of another dump, modifying its dump structure members. This race condition will result in NULL pointer dereference in kernel. So add a lock to prevent that race. Fixes: 83321d6b9872 ("[AF_KEY]: Dump SA/SP entries non-atomically") Signed-off-by: Yuej

[PATCH 2/2] af_key: Fix sadb_x_ipsecrequest parsing

2017-04-18 Thread Steffen Klassert
From: Herbert Xu The parsing of sadb_x_ipsecrequest is broken in a number of ways. First of all we're not verifying sadb_x_ipsecrequest_len. This is needed when the structure carries addresses at the end. Worse we don't even look at the length when we parse those optional addresses. The migrat

Re: FEC on i.MX 7 transmit queue timeout

2017-04-18 Thread Stefan Agner
Hi Andy, On 2017-04-18 19:24, Andy Duan wrote: > On 2017年04月19日 03:46, Stefan Agner wrote: >> Hi, >> >> I noticed last week on upstream (v4.11-rc6) on a Colibri iMX7 board that >> after a while (~10 minutes) the detdev wachdog prints a stacktrace and >> the driver then continuously dumps the TX ri

Re: [PATCH net-next 1/2 v2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Roopa Prabhu
On 4/18/17, 6:14 PM, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim > > When you dump hundreds of thousands of actions, getting only 32 per > dump batch even when the socket buffer and memory allocations allow > is inefficient. > > With this change, the user will get as many as possibly fitting

Re: Corrupted SKB

2017-04-18 Thread Michael Ma
2017-04-18 16:12 GMT-07:00 Cong Wang : > On Mon, Apr 17, 2017 at 5:39 PM, Michael Ma wrote: >> Hi - >> >> We've implemented a "glue" qdisc similar to mqprio which can associate >> one qdisc to multiple txqs as the root qdisc. Reference count of the >> child qdiscs have been adjusted properly in th

Re: [PATCH net-next 1/1] net sched actions: add time filter for action dumping

2017-04-18 Thread Jakub Kicinski
On Tue, 18 Apr 2017 21:37:12 -0400, Jamal Hadi Salim wrote: > On 17-04-18 06:12 PM, Jakub Kicinski wrote: > > > Noob question - would it be an option to establish some form of > > streaming statistic updates out of the kernel? > > It would be more efficient, certainly. Current polling approach

Re: [PATCH net-next 1/2 v2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Eric Dumazet
On Tue, 2017-04-18 at 22:32 -0400, Jamal Hadi Salim wrote: > On 17-04-18 09:49 PM, Eric Dumazet wrote: > > On Tue, 2017-04-18 at 21:14 -0400, Jamal Hadi Salim wrote: > >> From: Jamal Hadi Salim > > > > So there is no more limit ? How user is supposed to size the buffer for > > recvmsg() ? > > > >

Re: [PATCH net-next 1/2 v2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Jamal Hadi Salim
On 17-04-18 09:49 PM, Eric Dumazet wrote: On Tue, 2017-04-18 at 21:14 -0400, Jamal Hadi Salim wrote: From: Jamal Hadi Salim So there is no more limit ? How user is supposed to size the buffer for recvmsg() ? That part doesnt change. Ok, I believe more clarity is needed:-> Current code al

Re: [PATCH RFC] sparc64: eBPF JIT

2017-04-18 Thread David Miller
From: Alexei Starovoitov Date: Tue, 18 Apr 2017 15:57:09 -0700 > On Tue, Apr 18, 2017 at 02:37:32PM -0400, David Miller wrote: >> From: Alexei Starovoitov >> Date: Mon, 17 Apr 2017 22:44:47 -0700 >> >> > The way llvm generates stack access is: >> > rX = r10 >> > rX += imm >> > and that's the on

Re: [PATCH net-next]smsc911x: Adding support for Micochip LAN9250 Ethernet controller

2017-04-18 Thread Andrew Lunn
On Wed, Apr 19, 2017 at 12:29:45AM +, david@microchip.com wrote: > Attached is a patch which adding support for Microchip LAN9250 Ethernet > controller. Hi David It looks like your mail system mangled your patch. Please use git send-email. > > Thanks, > > = > David

Re: FEC on i.MX 7 transmit queue timeout

2017-04-18 Thread Andy Duan
On 2017年04月19日 03:46, Stefan Agner wrote: > Hi, > > I noticed last week on upstream (v4.11-rc6) on a Colibri iMX7 board that > after a while (~10 minutes) the detdev wachdog prints a stacktrace and > the driver then continuously dumps the TX ring. I then did a quick test > with 4.10, and realized

[PATCH net-next] tcp_cubic: fix typo in module param description

2017-04-18 Thread Chema Gonzalez
From: Chema Gonzalez Signed-off-by: Chema Gonzalez --- net/ipv4/tcp_cubic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c index c99230efcd52..0683ba447d77 100644 --- a/net/ipv4/tcp_cubic.c +++ b/net/ipv4/tcp_cubic.c @@ -72,7 +72,

Re: [PATCH v2 net 2/2] net sched actions: decrement module refcount earlier

2017-04-18 Thread Jamal Hadi Salim
On 17-04-18 01:03 PM, Cong Wang wrote: On Tue, Apr 18, 2017 at 3:13 AM, Wolfgang Bumiller wrote: police action...That is why I said we may need a TCA_POLICE_COOKIE. Unless it is very old user space code (which wouldnt know what a cookie is), dont think there's much use of direct policer ac

Re: [PATCH net] xfrm: calculate L4 checksums also for GSO case before encrypting packets

2017-04-18 Thread Ansis Atteka
On 18 April 2017 at 02:09, Steffen Klassert wrote: > On Thu, Apr 13, 2017 at 07:45:08PM -0700, Ansis Atteka wrote: >> On 11 April 2017 at 00:07, Steffen Klassert >> wrote: >> > >> > What's wrong with the checksum provided by the GSO layer and >> > why we have to do this unconditionally here? >> >

Re: [PATCH net-next 1/2 v2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Eric Dumazet
On Tue, 2017-04-18 at 21:14 -0400, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim So there is no more limit ? How user is supposed to size the buffer for recvmsg() ? > t->tca__pad1 = 0; > @@ -1113,6 +1133,9 @@ static int tc_dump_action(struct sk_buff *skb, struct > netlink_callback *cb)

Re: [PATCH net-next 2/2 v2] net sched actions: add time filter for action dumping

2017-04-18 Thread Jamal Hadi Salim
On 17-04-18 09:35 PM, Eric Dumazet wrote: On Tue, 2017-04-18 at 21:14 -0400, Jamal Hadi Salim wrote: From: Jamal Hadi Salim + if (tcaa[TCAA_ACT_TIME_FILTER]) + msecs_filter = nla_get_u32(tcaa[TCAA_ACT_TIME_FILTER]); You forgot to add TCAA_ACT_TIME_FILTER in tcaa_polic

Re: [PATCH net-next 1/1] net sched actions: add time filter for action dumping

2017-04-18 Thread Jamal Hadi Salim
On 17-04-18 06:12 PM, Jakub Kicinski wrote: Noob question - would it be an option to establish some form of streaming statistic updates out of the kernel? It would be more efficient, certainly. Current polling approach is not as bad though (you send one extra kernel message) and is more reliab

Re: [PATCH net-next 2/2 v2] net sched actions: add time filter for action dumping

2017-04-18 Thread Eric Dumazet
On Tue, 2017-04-18 at 21:14 -0400, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim > > + if (tcaa[TCAA_ACT_TIME_FILTER]) > + msecs_filter = nla_get_u32(tcaa[TCAA_ACT_TIME_FILTER]); You forgot to add TCAA_ACT_TIME_FILTER in tcaa_policy There is no guarantee user passed 32bit d

[PATCH net-next 2/2] Add Jiri Pirko as TC subsystem co-maintainer

2017-04-18 Thread Jamal Hadi Salim
From: Jamal Hadi Salim Signed-off-by: Jamal Hadi Salim --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 749bd84..a9df81e 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -12190,6 +12190,7 @@ F: kernel/taskstats.c TC subsystem M: Jamal H

[PATCH net-next 1/2] Add Cong Wang as TC subsystem co-maintainer

2017-04-18 Thread Jamal Hadi Salim
From: Jamal Hadi Salim Signed-off-by: Jamal Hadi Salim --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 1973878..749bd84 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -12189,6 +12189,7 @@ F: kernel/taskstats.c TC subsystem M: Jamal

[PATCH net-next 2/2 v2] net sched actions: add time filter for action dumping

2017-04-18 Thread Jamal Hadi Salim
From: Jamal Hadi Salim This adds support for filtering based on time since last used. When we are dumping a large number of actions it is useful to have the option of filtering based on when the action was last used to reduce the amount of data crossing to user space. With this patch the user sp

[PATCH net-next 1/2 v2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Jamal Hadi Salim
From: Jamal Hadi Salim When you dump hundreds of thousands of actions, getting only 32 per dump batch even when the socket buffer and memory allocations allow is inefficient. With this change, the user will get as many as possibly fitting within the given constraints available to the kernel. A

Re: [PATCH net-next 1/2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Jamal Hadi Salim
Please ignore - I will resend. This is corrupt. Sorry - I will label the next one as v2 even though it is v3. cheers, jamal On 17-04-18 09:08 PM, Jamal Hadi Salim wrote: From: Jamal Hadi Salim When you dump hundreds of thousands of actions, getting only 32 per dump batch even when the socket

Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone

2017-04-18 Thread Andrey Konovalov
On Wed, Apr 19, 2017 at 1:20 AM, David Ahern wrote: > On 4/18/17 2:43 PM, Andrey Konovalov wrote: >> I've finally managed to reproduce one of the crashes on commit >> 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7). >> >> I'm not sure if this bug has the same root cause as the first one >> rep

[PATCH net-next 1/2] net sched actions: dump more than TCA_ACT_MAX_PRIO actions per batch

2017-04-18 Thread Jamal Hadi Salim
From: Jamal Hadi Salim When you dump hundreds of thousands of actions, getting only 32 per dump batch even when the socket buffer and memory allocations allow is inefficient. With this change, the user will get as many as possibly fitting within the given constraints available to the kernel. A

[PATCH net-next 2/2] net sched actions: add time filter for action dumping

2017-04-18 Thread Jamal Hadi Salim
From: Jamal Hadi Salim This adds support for filtering based on time since last used. When we are dumping a large number of actions it is useful to have the option of filtering based on when the action was last used to reduce the amount of data crossing to user space. With this patch the user sp

Re: question about size of sk_buff and skb_shared_info

2017-04-18 Thread Eric Dumazet
For the last time, do not top post on netdev. On Tue, 2017-04-18 at 17:15 -0700, Code Soldier1 wrote: > I am not suggesting that we do not do cache alignment. That is > required for performance. I have gone through this exercise because I > need to add a field to sk_buff and I want to do that wit

[PATCH net-next]smsc911x: Adding support for Micochip LAN9250 Ethernet controller

2017-04-18 Thread David.Cai
Attached is a patch which adding support for Microchip LAN9250 Ethernet controller. Thanks, = David Cai Principle Software Engineer Microchip Technology Inc. = Signed-off-by: David Cai --- drivers/net/ethernet/smsc/smsc911x.c | 32 +++

Re: question about size of sk_buff and skb_shared_info

2017-04-18 Thread Code Soldier1
I am not suggesting that we do not do cache alignment. That is required for performance. I have gone through this exercise because I need to add a field to sk_buff and I want to do that without causing any adverse effects. Now that we have discovered that there are 40 bytes that can be used withou

Re: [PATCH net-next v6 00/11] Landlock LSM: Toward unprivileged sandboxing

2017-04-18 Thread Mickaël Salaün
On 19/04/2017 01:26, Kees Cook wrote: > On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >> This sixth series add some changes to the previous one [1], including a >> simpler >> rule inheritance hierarchy (similar to seccomp-bpf), a ptrace scope >> protection, >> some file renaming (bette

Re: [PATCH net-next v6 09/11] seccomp: Enhance test_harness with an assert step mechanism

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > This is useful to return an information about the error without being > able to write to TH_LOG_STREAM. > > Helpers from test_harness.h may be useful outside of the seccomp > directory. > > Signed-off-by: Mickaël Salaün > Cc: Andy Lutomirsk

Re: [PATCH net-next v6 10/11] bpf,landlock: Add tests for Landlock

2017-04-18 Thread Kees Cook
On Tue, Apr 18, 2017 at 4:53 PM, Mickaël Salaün wrote: > On 19/04/2017 01:16, Kees Cook wrote: >> On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >>> --- /dev/null >>> +++ b/tools/testing/selftests/landlock/Makefile >>> @@ -0,0 +1,47 @@ >>> +LIBDIR := ../../../lib >>> +BPFOBJ := $(LIBDIR)/

Re: question about size of sk_buff and skb_shared_info

2017-04-18 Thread Eric Dumazet
Please do not top post on netdev On Tue, 2017-04-18 at 16:26 -0700, Code Soldier1 wrote: > Eric, > > This alignment flag is passed to the cache constructor and the > allocation is indeed cache aligned. However, since the allocated size > is not a multiple of the alignment, wont memory be wasted ?

Re: [PATCH net-next v6 10/11] bpf,landlock: Add tests for Landlock

2017-04-18 Thread Mickaël Salaün
On 19/04/2017 01:16, Kees Cook wrote: > On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >> Test basic context access, ptrace protection and filesystem event with >> multiple cases. >> >> Changes since v5: >> * add subtype test >> * add ptrace tests >> * split and rename files >> * cleanup

Re: [Patch net-next v3] net_sched: move the empty tp check from ->destroy() to ->delete()

2017-04-18 Thread Daniel Borkmann
On 04/18/2017 10:55 PM, Cong Wang wrote: On Tue, Apr 18, 2017 at 10:01 AM, Daniel Borkmann wrote: Hi Cong, sorry for the late reply. Generally the patch looks good to me, just a few comments inline: On 04/17/2017 08:30 PM, Cong Wang wrote: Roi reported we could have a race condition where i

Re: [PATCH 1/5] netlink: extended ACK reporting

2017-04-18 Thread Joe Stringer
On 18 April 2017 at 02:41, Johannes Berg wrote: > On Thu, 2017-04-13 at 14:44 -0700, Joe Stringer wrote > (something that never made it to the list, due to HTML formatting) >> >> I think that OVS was doing some more elaborate validation than most >> users, so over time we picked up a bunch of extr

Re: [PATCH net-next v6 06/11] seccomp,landlock: Handle Landlock events per process hierarchy

2017-04-18 Thread Kees Cook
On Tue, Apr 18, 2017 at 4:24 PM, Mickaël Salaün wrote: > On 19/04/2017 00:53, Kees Cook wrote: >> On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >>> +#ifdef CONFIG_SECCOMP_FILTER >> >> Isn't CONFIG_SECCOMP_FILTER already required for landlock? > > Yes it is, but Landlock could only/also b

Re: [PATCH net-next v6 04/11] landlock: Add LSM hooks related to filesystem

2017-04-18 Thread Kees Cook
On Tue, Apr 18, 2017 at 4:16 PM, Casey Schaufler wrote: > On 4/18/2017 3:44 PM, Mickaël Salaün wrote: >> On 19/04/2017 00:17, Kees Cook wrote: >>> On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: +void __init landlock_add_hooks(void) +{ + pr_info("landlock: Version %u",

Re: [PATCH net-next v6 04/11] landlock: Add LSM hooks related to filesystem

2017-04-18 Thread Kees Cook
On Tue, Apr 18, 2017 at 3:44 PM, Mickaël Salaün wrote: > > On 19/04/2017 00:17, Kees Cook wrote: >> On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >>> Handle 33 filesystem-related LSM hooks for the Landlock filesystem >>> event: LANDLOCK_SUBTYPE_EVENT_FS. >>> >>> A Landlock event wrap LSM

Re: [PATCH net-next v6 08/11] bpf: Add a Landlock sandbox example

2017-04-18 Thread Mickaël Salaün
On 19/04/2017 01:06, Kees Cook wrote: > On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >> Add a basic sandbox tool to create a process isolated from some part of >> the system. This sandbox create a read-only environment. It is only >> allowed to write to a character device such as a TTY:

Re: question about size of sk_buff and skb_shared_info

2017-04-18 Thread Code Soldier1
Eric, This alignment flag is passed to the cache constructor and the allocation is indeed cache aligned. However, since the allocated size is not a multiple of the alignment, wont memory be wasted ?. We can get 40 extra bytes without any side effects since they are on the same cache line ? kmem_c

Re: [PATCH net-next v6 00/11] Landlock LSM: Toward unprivileged sandboxing

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > This sixth series add some changes to the previous one [1], including a > simpler > rule inheritance hierarchy (similar to seccomp-bpf), a ptrace scope > protection, > some file renaming (better feature identification per file), a future-p

Re: [PATCH net-next v6 06/11] seccomp,landlock: Handle Landlock events per process hierarchy

2017-04-18 Thread Mickaël Salaün
On 19/04/2017 00:53, Kees Cook wrote: > On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >> The seccomp(2) syscall can be used by a task to apply a Landlock rule to >> itself. As a seccomp filter, a Landlock rule is enforced for the current >> task and all its future children. A rule is im

Re: [PATCH v2 0/8] NFC: fix device allocation and nfcmrvl crashes

2017-04-18 Thread Samuel Ortiz
Hi Johan, On Tue, Apr 18, 2017 at 12:09:16PM +0200, Johan Hovold wrote: > On Thu, Mar 30, 2017 at 12:15:34PM +0200, Johan Hovold wrote: > > This started out with the observation that the nfcmrvl_uart driver > > unconditionally dereferenced the tty class device despite the fact that > > not every t

Re: net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone

2017-04-18 Thread David Ahern
On 4/18/17 2:43 PM, Andrey Konovalov wrote: > I've finally managed to reproduce one of the crashes on commit > 4f7d029b9bf009fbee76bb10c0c4351a1870d2f3 (4.11-rc7). > > I'm not sure if this bug has the same root cause as the first one > reported in this thread, but it definitely has to do with ipv6

RE: [PATCH v2] smsc95xx: Use skb_cow_head to deal with cloned skbs

2017-04-18 Thread Woojung.Huh
> if (info->tx_fixup) { >skb = info->tx_fixup (dev, skb, GFP_ATOMIC); > >if (!skb) { // Note that skb is NULL now You are right. skb is return value of tx_fixup(). - Woojung

Re: [PATCH net-next v6 10/11] bpf,landlock: Add tests for Landlock

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > Test basic context access, ptrace protection and filesystem event with > multiple cases. > > Changes since v5: > * add subtype test > * add ptrace tests > * split and rename files > * cleanup and rebase > > Signed-off-by: Mickaël Salaün > C

Re: [PATCH net-next v6 04/11] landlock: Add LSM hooks related to filesystem

2017-04-18 Thread Casey Schaufler
On 4/18/2017 3:44 PM, Mickaël Salaün wrote: > On 19/04/2017 00:17, Kees Cook wrote: >> On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >>> Handle 33 filesystem-related LSM hooks for the Landlock filesystem >>> event: LANDLOCK_SUBTYPE_EVENT_FS. >>> >>> A Landlock event wrap LSM hooks for sim

Re: Corrupted SKB

2017-04-18 Thread Cong Wang
On Mon, Apr 17, 2017 at 5:39 PM, Michael Ma wrote: > Hi - > > We've implemented a "glue" qdisc similar to mqprio which can associate > one qdisc to multiple txqs as the root qdisc. Reference count of the > child qdiscs have been adjusted properly in this case so that it > represents the number of

Re: [PATCH v3 net-next RFC] Generic XDP

2017-04-18 Thread Alexei Starovoitov
On Tue, Apr 18, 2017 at 11:47:59AM +0200, Johannes Berg wrote: > > I guess any driver that would care about XDP performance would either > > implement in-driver XDP or make sure that skb_linearize() doesn't > > happen in generic XDP by doing build_skb() with the whole packet. > > The driver can be

Re: [PATCH net-next v6 08/11] bpf: Add a Landlock sandbox example

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > Add a basic sandbox tool to create a process isolated from some part of > the system. This sandbox create a read-only environment. It is only > allowed to write to a character device such as a TTY: > > # :> X > # echo $? > 0 > # ./sa

Re: [PATCH net-next] net: ipv6: Add early demux handler for UDP unicast

2017-04-18 Thread Simon Horman
On Tue, Apr 18, 2017 at 08:09:08PM +0200, Hannes Frederic Sowa wrote: > > > On Tue, Apr 18, 2017, at 17:16, David Miller wrote: > > From: Simon Horman > > Date: Tue, 18 Apr 2017 17:09:04 +0900 > > > > > On Wed, Mar 08, 2017 at 11:22:01AM -0800, Eric Dumazet wrote: > > >> On Wed, 2017-03-08 at 1

Re: [PATCH v3 net-next RFC] Generic XDP

2017-04-18 Thread Alexei Starovoitov
On Tue, Apr 18, 2017 at 02:46:25PM -0400, David Miller wrote: > From: Alexei Starovoitov > Date: Mon, 17 Apr 2017 16:04:38 -0700 > > > On Mon, Apr 17, 2017 at 03:49:55PM -0400, David Miller wrote: > >> From: Jesper Dangaard Brouer > >> Date: Sun, 16 Apr 2017 22:26:01 +0200 > >> > >> > The bpf t

[net-next 11/15] ixgbe: Remove unused define

2017-04-18 Thread Jeff Kirsher
From: Don Skidmore Remove the Marvell 1145 PHY define as we have never had a device that supports it and have no plan to in the future. The existence of this define has caused confusing on whether or not this PHY was supported by ixgbe. Signed-off-by: Don Skidmore Tested-by: Andrew Bowers Sig

[net-next 13/15] ixgbe: add check for VETO bit when configuring link for KR

2017-04-18 Thread Jeff Kirsher
From: Tony Nguyen We did not have a check in place for MMNGC.MNG_VETO when setting up link on X550EM_X KR devices which resulted in link loss for the BMC when loading the driver. This patch adds a check for ixgbe_check_reset_blocked() in setup_link() since in that case there is no PHY reset func

[net-next 12/15] ixgbevf: use new api ethtool_{get|set}_link_ksettings

2017-04-18 Thread Jeff Kirsher
From: Philippe Reynes The ethtool api {get|set}_settings is deprecated. We move this driver to new api {get|set}_link_ksettings. As I don't have the hardware, I'd be very pleased if someone may test this patch. Signed-off-by: Philippe Reynes Tested-by: Andrew Bowers Signed-off-by: Jeff Kirshe

[net-next 14/15] ixgbe: Add support for maximum headroom when using build_skb

2017-04-18 Thread Jeff Kirsher
From: Alexander Duyck This patch increases the headroom allocated when using build_skb on a system with 4K pages. Specifically the breakdown of headroom versus cache size is as follows: L1 Cache Size Headroom 64 192 64, NET_IP_ALIGN == 2 194 128

[net-next 05/15] ixgbe: Add X552 XFI backplane support

2017-04-18 Thread Jeff Kirsher
From: Don Skidmore This patch add support for X552 XFI backplane interface. The XFI backplane requires a custom tuned link. HW/FW owns the link config for XF backplane and SW must not interfere with it. Signed-off-by: Don Skidmore Tested-by: Krishneil Singh Signed-off-by: Jeff Kirsher ---

[net-next 01/15] ixgbe: Avoid Tx hang by not allowing more than the number of VFs supported.

2017-04-18 Thread Jeff Kirsher
From: Usha Ketineni When DCB is enabled, add checks to ensure creation of number of VF's is valid based on the traffic classes configured by the device. Signed-off-by: Usha Ketineni Tested-by: Ronald Bynoe Signed-off-by: Jeff Kirsher --- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 26 ++

[net-next 06/15] ixgbe: list X553 backplane speeds correctly

2017-04-18 Thread Jeff Kirsher
From: Don Skidmore We forgot to indicate some of the supported speed on the X553 backplane. This patch attempts to correct for that. Signed-off-by: Don Skidmore Tested-by: Krishneil Singh Signed-off-by: Jeff Kirsher --- drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 5 + drivers/net/e

[net-next 04/15] ixgbe: Complete support for X553 sgmii

2017-04-18 Thread Jeff Kirsher
From: Don Skidmore The initial patches supporting X553 sgmii forgot some details. This patch should cover those missing spots. Signed-off-by: Don Skidmore Tested-by: Krishneil Singh Signed-off-by: Jeff Kirsher --- drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 29 +-

[net-next 09/15] ixgbe: return early instead of wrap block in if statement

2017-04-18 Thread Jeff Kirsher
From: Emil Tantilov Since we exit at the end of the block, we can save a level of indentation by performing an early return, and make the next several sections of code more legible, with fewer 80 character line breaks. Also moved allocating vfinfo at the beginning and the notification for enabli

[net-next 07/15] ixgbe: add default setup_link for x550em_a MAC type

2017-04-18 Thread Jeff Kirsher
From: Emil Tantilov Add default setting for mac->ops.setup_link on x550em_a MAC types. This fixes a link issue on KR parts. Signed-off-by: Emil Tantilov Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher --- drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 2 +- 1 file changed, 1 insertion(

[net-next 02/15] ixgbe: Remove pr_cont uses

2017-04-18 Thread Jeff Kirsher
From: Joe Perches As pr_cont output can be interleaved by other processes, using pr_cont should be avoided where possible. Miscellanea: - Use a temporary pointer to hold the next descriptions and consolidate the pr_cont uses - Use the temporary buffer to hold the 8 u32 register values and e

[net-next 08/15] ixgbe: move num_vfs_macvlans allocation into separate function

2017-04-18 Thread Jeff Kirsher
From: Emil Tantilov Move the code allocating memory for list of MAC addresses that the VFs can use for MACVLAN into its own function. Signed-off-by: Emil Tantilov Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher --- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 48

[net-next 03/15] ixgbe: Remove driver config for KX4 PHY

2017-04-18 Thread Jeff Kirsher
From: Tony Nguyen The KX4 PHY is configured by the NVM. Currently, the driver is overwriting the config; remove the code associated with KX4 configuration. Signed-off-by: Tony Nguyen Tested-by: Krishneil Singh --- drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 3 +- drivers/net/ethernet/i

[net-next 00/15][pull request] 10GbE Intel Wired LAN Driver Updates 2017-04-18

2017-04-18 Thread Jeff Kirsher
This series contains updates to mainly ixgbe with only one ixgbevf change. Usha adds a check to ensure the creation of number of VF's is valid based on the traffic classes configured, all to avoid transmit hangs. Joe Perches reduces the use of pr_cont since the output can be interleaved by other

[net-next 15/15] ixgbe: Fix output from ixgbe_dump

2017-04-18 Thread Jeff Kirsher
From: Alexander Duyck I just found that when we had changed the Rx path to check for length instead of the DD bit we introduced an issue in ixgbe_dump since we were no longer clearing the status bits. To correct this I am updating ixgbe_dump to look for the length bits in the descriptor since th

[net-next 10/15] ixgbe: do not use adapter->num_vfs when setting VFs via module parameter

2017-04-18 Thread Jeff Kirsher
From: Emil Tantilov Avoid setting adapter->num_vfs early in the init code path when using the max_vfs module parameter by passing it to ixgbe_enable_sriov() as a function parameter. This fixes an issue where if we failed to allocate vfinfo in __ixgbe_enable_sriov() the driver will crash with NUL

Re: [PATCH RFC] sparc64: eBPF JIT

2017-04-18 Thread Alexei Starovoitov
On Tue, Apr 18, 2017 at 02:37:32PM -0400, David Miller wrote: > From: Alexei Starovoitov > Date: Mon, 17 Apr 2017 22:44:47 -0700 > > > The way llvm generates stack access is: > > rX = r10 > > rX += imm > > and that's the only thing verifier recognizes as valid ptr_to_stack. > > Like rX -= imm wil

Re: [kernel-hardening] [PATCH net-next v6 06/11] seccomp,landlock: Handle Landlock events per process hierarchy

2017-04-18 Thread Kees Cook
On Fri, Mar 31, 2017 at 2:15 PM, Mickaël Salaün wrote: > > > On 29/03/2017 12:35, Djalal Harouni wrote: >> On Wed, Mar 29, 2017 at 1:46 AM, Mickaël Salaün wrote: > >>> @@ -25,6 +30,9 @@ struct seccomp_filter; >>> struct seccomp { >>> int mode; >>> struct seccomp_filter *filter; >

Re: [PATCH net-next v6 06/11] seccomp,landlock: Handle Landlock events per process hierarchy

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > The seccomp(2) syscall can be used by a task to apply a Landlock rule to > itself. As a seccomp filter, a Landlock rule is enforced for the current > task and all its future children. A rule is immutable and a task can > only add new restric

Re: [PATCH net-next v6 05/11] seccomp: Split put_seccomp_filter() with put_seccomp()

2017-04-18 Thread Mickaël Salaün
On 19/04/2017 00:23, Kees Cook wrote: > On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >> The semantic is unchanged. This will be useful for the Landlock >> integration with seccomp (next commit). >> >> Signed-off-by: Mickaël Salaün >> Cc: Kees Cook >> Cc: Andy Lutomirski >> Cc: Will D

Re: [PATCH v2] smsc95xx: Use skb_cow_head to deal with cloned skbs

2017-04-18 Thread Eric Dumazet
On Tue, 2017-04-18 at 22:09 +, woojung@microchip.com wrote: > > > @@ -2067,13 +2067,9 @@ static struct sk_buff *smsc95xx_tx_fixup(struct > > usbnet *dev, > > > /* We do not advertise SG, so skbs should be already linearized */ > > > BUG_ON(skb_shinfo(skb)->nr_frags); > > > > > > - if (s

Re: [PATCH net-next v6 04/11] landlock: Add LSM hooks related to filesystem

2017-04-18 Thread Mickaël Salaün
On 19/04/2017 00:17, Kees Cook wrote: > On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: >> Handle 33 filesystem-related LSM hooks for the Landlock filesystem >> event: LANDLOCK_SUBTYPE_EVENT_FS. >> >> A Landlock event wrap LSM hooks for similar kernel object types (e.g. >> struct file, str

Re: IGMP on IPv6

2017-04-18 Thread Cong Wang
On Tue, Apr 18, 2017 at 10:20 AM, Murali Karicheri wrote: > On 04/18/2017 01:12 PM, Murali Karicheri wrote: >> On 04/17/2017 05:38 PM, Cong Wang wrote: >>> Hello, >>> >>> On Thu, Apr 13, 2017 at 9:36 AM, Murali Karicheri >>> wrote: On 03/22/2017 11:04 AM, Murali Karicheri wrote: > This

Re: [PATCH net-next v6 05/11] seccomp: Split put_seccomp_filter() with put_seccomp()

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > The semantic is unchanged. This will be useful for the Landlock > integration with seccomp (next commit). > > Signed-off-by: Mickaël Salaün > Cc: Kees Cook > Cc: Andy Lutomirski > Cc: Will Drewry > --- > include/linux/seccomp.h | 4 ++-

Re: [PATCH net-next v6 04/11] landlock: Add LSM hooks related to filesystem

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > Handle 33 filesystem-related LSM hooks for the Landlock filesystem > event: LANDLOCK_SUBTYPE_EVENT_FS. > > A Landlock event wrap LSM hooks for similar kernel object types (e.g. > struct file, struct path...). Multiple LSM hooks can trigger t

Re: [PATCH net-next 1/1] net sched actions: add time filter for action dumping

2017-04-18 Thread Jakub Kicinski
On Sun, 16 Apr 2017 09:56:13 -0400, Jamal Hadi Salim wrote: > From: Jamal Hadi Salim > > This adds support for filtering based on time since last used. > When we are dumping a large number of actions it is useful to > have the option of filtering based on when the action was last > used to reduce

RE: [PATCH v2] smsc95xx: Use skb_cow_head to deal with cloned skbs

2017-04-18 Thread Woojung.Huh
> > @@ -2067,13 +2067,9 @@ static struct sk_buff *smsc95xx_tx_fixup(struct > usbnet *dev, > > /* We do not advertise SG, so skbs should be already linearized */ > > BUG_ON(skb_shinfo(skb)->nr_frags); > > > > - if (skb_headroom(skb) < overhead) { > > - struct sk_buff *skb2 = skb_

Re: [PATCH net-next v6 02/11] bpf,landlock: Define an eBPF program type for Landlock

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > Add a new type of eBPF program used by Landlock rules. > > This new BPF program type will be registered with the Landlock LSM > initialization. > > Add an initial Landlock Kconfig. > > Changes since v5: > * rename file hooks.c to init.c > *

Re: [PATCH net-next v6 01/11] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-04-18 Thread Kees Cook
On Tue, Mar 28, 2017 at 4:46 PM, Mickaël Salaün wrote: > The goal of the program subtype is to be able to have different static > fine-grained verifications for a unique program type. > > The struct bpf_verifier_ops gets a new optional function: > is_valid_subtype(). This new verifier is called at

Re: [PATCH next 2/5] bonding: initialize work-queues during creation of bond

2017-04-18 Thread महेश बंडेवार
On Tue, Apr 18, 2017 at 2:23 PM, Andy Gospodarek wrote: > On Fri, Apr 14, 2017 at 03:44:53PM -0700, Joe Stringer wrote: >> On 8 March 2017 at 10:55, Mahesh Bandewar wrote: >> > From: Mahesh Bandewar >> > >> > Initializing work-queues every time ifup operation performed is unnecessary >> > and ca

Re: [PATCH next 2/5] bonding: initialize work-queues during creation of bond

2017-04-18 Thread Andy Gospodarek
On Fri, Apr 14, 2017 at 03:44:53PM -0700, Joe Stringer wrote: > On 8 March 2017 at 10:55, Mahesh Bandewar wrote: > > From: Mahesh Bandewar > > > > Initializing work-queues every time ifup operation performed is unnecessary > > and can be performed only once when the port is created. > > > > Signe

[PATCH v2 0/3] uapi glibc compat: fix musl libc compatibility

2017-04-18 Thread Hauke Mehrtens
The code from libc-compat.h depends on some glibc specific defines and causes compile problems with the musl libc. These patches remove some of the glibc dependencies. With these patches the LEDE (OpenWrt) base user space applications can be build with unmodified kernel headers and musl libc.

[PATCH v2 3/3] uapi/if_ether.h: prevent redefinition of struct ethhdr

2017-04-18 Thread Hauke Mehrtens
From: David Heidelberger Musl provides its own ethhdr struct definition. Add a guard to prevent its definition of the appropriate musl header has already been included. Acked-by: Mikko Rapeli Signed-off-by: John Spencer Tested-by: David Heidelberger Signed-off-by: Jonas Gorski Signed-off-by:

[PATCH v2 1/3] uapi glibc compat: add libc compat code when not build for kernel

2017-04-18 Thread Hauke Mehrtens
Instead of checking if this header file is used in the glibc, check if it is not used in kernel context, this way it will also work with other libc implementations like musl. The __USE_MISC symbol is glibc specific and not available in musl libc. Only do this check when glibc is used. This is bas

  1   2   3   >