summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-04-20docs-rst: usb: update old usbfs-related documentationMauro Carvalho Chehab
There's no usbfs anymore. The old features are now either exported to /dev/bus/usb or via debugfs. Update documentation accordingly, pointing to the new places where the character devices and usb/devices are now placed. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2017-04-20blk-mq: Add a polling specific stats functionStephen Bates
Rather than bucketing IO statisics based on direction only we also bucket based on the IO size. This leads to improved polling performance. Update the bucket callback function and use it in the polling latency estimation. Signed-off-by: Stephen Bates <sbates@raithlin.com> Signed-off-by: Jens Axboe <axboe@fb.com>
2017-04-20blk-stat: convert blk-stat bucket callback to signedStephen Bates
In order to allow for filtering of IO based on some other properties of the request than direction we allow the bucket function to return an int. If the bucket callback returns a negative do no count it in the stats accumulation. Signed-off-by: Stephen Bates <sbates@raithlin.com> Fixed up Kyber scheduler stat callback. Signed-off-by: Jens Axboe <axboe@fb.com>
2017-04-20blk-mq: fix potential oops with polling and blk-mq schedulerJens Axboe
If we have a scheduler attached, blk_mq_tag_to_rq() on the scheduled tags will return NULL if a request is no longer in flight. This is different than using the normal tags, where it will always return the fixed request. Check for this condition for polling, in case we happen to enter polling for a completed request. The request address remains valid, so this check and return should be perfectly safe. Fixes: bd166ef183c2 ("blk-mq-sched: add framework for MQ capable IO schedulers") Tested-by: Stephen Bates <sbates@raithlin.com> Signed-off-by: Jens Axboe <axboe@fb.com>
2017-04-20nvme: Quirk APST off on "THNSF5256GPUK TOSHIBA"Andy Lutomirski
There's a report that it malfunctions with APST on. See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678184 Cc: Kai-Heng Feng <kai.heng.feng@canonical.com> Signed-off-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Jens Axboe <axboe@fb.com>
2017-04-20nvme: Adjust the Samsung APST quirkAndy Lutomirski
I got a couple more reports: the Samsung APST issues appears to affect multiple 950-series devices in Dell XPS 15 9550 and Precision 5510 laptops. Change the quirk: rather than blacklisting the firmware on the first problematic SSD that was reported, disable APST on all 144d:a802 devices if they're installed in the two affected Dell models. While we're at it, disable only the deepest sleep state instead of all of them -- the reporters say that this is sufficient to fix the problem. (I have a device that appears to be entirely identical to one of the affected devices, but I have a different Dell laptop, so it's not the case that all Samsung devices with firmware BXW75D0Q are broken under all circumstances.) Samsung engineers have an affected system, and hopefully they'll give us a better workaround some time soon. In the mean time, this should minimize regressions. See https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678184 Cc: Kai-Heng Feng <kai.heng.feng@canonical.com> Signed-off-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Jens Axboe <axboe@fb.com>
2017-04-20net sched actions: allocate act cookie earlyWolfgang Bumiller
Policing filters do not use the TCA_ACT_* enum and the tb[] nlattr array in tcf_action_init_1() doesn't get filled for them so we should not try to look for a TCA_ACT_COOKIE attribute in the then uninitialized array. The error handling in cookie allocation then calls tcf_hash_release() leading to invalid memory access later on. Additionally, if cookie allocation fails after an already existing non-policing filter has successfully been changed, tcf_action_release() should not be called, also we would have to roll back the changes in the error handling, so instead we now allocate the cookie early and assign it on success at the end. CVE-2017-7979 Fixes: 1045ba77a596 ("net sched actions: Add support for user cookies") Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20IB/hns: Use kcalloc() in hns_roce_buddy_init()Markus Elfring
* Multiplications for the size determination of memory allocations indicated that array data structures should be processed. Thus use the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. * Replace the specification of data types by pointer dereferences to make the corresponding size determinations a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20IB/hns: Use kmalloc_array() in hns_roce_cmd_use_events()Markus Elfring
* A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. * Replace the specification of a data structure by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20Merge branch 'qed-dcbx-fixes'David S. Miller
Sudarsana Reddy Kalluru says: ==================== qed: Dcbx bug fixes The series has set of bug fixes for dcbx implementation of qed driver. Please consider applying this to 'net' branch. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20qed: Fix issue in populating the PFC config paramters.sudarsana.kalluru@cavium.com
Change ieee_setpfc() callback implementation to populate traffic class count with the user provided value. Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20qed: Fix possible system hang in the dcbnl-getdcbx() path.sudarsana.kalluru@cavium.com
qed_dcbnl_get_dcbx() API uses kmalloc in GFT_KERNEL mode. The API gets invoked in the interrupt context by qed_dcbnl_getdcbx callback. Need to invoke this kmalloc in atomic mode. Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20qed: Fix sending an invalid PFC error mask to MFW.sudarsana.kalluru@cavium.com
PFC error-mask value is not supported by MFW, but this bit could be set in the pfc bit-map of the operational parameters if remote device supports it. These operational parameters are used as basis for populating the dcbx config parameters. User provided configs will be applied on top of these parameters and then send them to MFW when requested. Driver need to clear the error-mask bit before sending the config parameters to MFW. Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20qed: Fix possible error in populating max_tc field.sudarsana.kalluru@cavium.com
Some adapters may not publish the max_tc value. Populate the default value for max_tc field in case the mfw didn't provide one. Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20smsc95xx: Use skb_cow_head to deal with cloned skbsJames Hughes
The driver was failing to check that the SKB wasn't cloned before adding checksum data. Replace existing handling to extend/copy the header buffer with skb_cow_head. Signed-off-by: James Hughes <james.hughes@raspberrypi.org> Acked-by: Eric Dumazet <edumazet@google.com> Acked-by: Woojung Huh <Woojung.Huh@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20platform/x86: hp-wmi: Cleanup exit pathsDarren Hart (VMware)
Several exit paths were more complex than they needed to be. Remove superfluous conditionals, use labels common cleanup, do not shadow negative error codes. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20platform/x86: hp-wmi: Do not shadow errors in sysfs show functionsDarren Hart (VMware)
The new hp_wmi_read_int function returns a negative value in case of error, pass this on directly rather than always replacing it with -EINVAL. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20platform/x86: hp-wmi: Use DEVICE_ATTR_(RO|RW) helper macrosDarren Hart (VMware)
Use the DEVICE_ATTR_(RO|RW) macros, ranaming the show and store functions accordingly. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20platform/x86: hp-wmi: Refactor dock and tablet state fetchersDarren Hart (VMware)
Both dock and tablet use the HPWMI_HARDWARE_QUERY, but require different masks. Rather than using two functions with magic masks, define the masks, and use a common accessor. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20platform/x86: hp-wmi: Cleanup wireless get_(hw|sw)state functionsDarren Hart (VMware)
Use the new hp_wmi_read_int() function and add a WARN_ONCE() to the TBD regarding passing the error through. These are used in a null return function unfortunately. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20platform/x86: hp-wmi: Refactor redundant HPWMI_READ functionsDarren Hart (VMware)
Several functions perform the same WMI read int with different query arguments. Refactor this into a single hp_wmi_read_int function. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20net/mlx5e: IPoIB, Fix error handling in mlx5_rdma_netdev_alloc()Dan Carpenter
The labels were out of order, so it either could result in an Oops or a leak. Fixes: 48935bbb7ae8 ("net/mlx5e: IPoIB, Add netdevice profile skeleton") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20platform/x86: hp-wmi: Standardize enum usage for constantsDarren Hart (VMware)
Use enums consistently throughout the hp-wmi driver for groups of related constants. Use hex and align the assignment within groups. Move the *QUERY constants into an enum, create a new enum defining the READ, WRITE, and ODM constants and use them instead of 0 and 1 at the call sites. Set the command directly instead of using the ternary operator since both 1 and 3 as previously documented would result in the command being set to 0x2. Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org> Tested-by: Carlo Caione <carlo@endlessm.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
2017-04-20md: handle read-only member devices better.NeilBrown
1/ If an array has any read-only devices when it is started, the array itself must be read-only 2/ A read-only device cannot be added to an array after it is started. 3/ Setting an array to read-write should not succeed if any member devices are read-only Reported-and-Tested-by: Nanda Kishore Chinnaram <Nanda_Kishore_Chinna@dell.com> Signed-off-by: NeilBrown <neilb@suse.com> Signed-off-by: Shaohua Li <shli@fb.com>
2017-04-20IB/hfi1: Coding style improvement (make sizeof use safer)Markus Elfring
Replace the specification of a data structure by a reference to the desired member as the parameter for the operator "sizeof" to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20IB/hfi1: Remove intermediate var in hfi1_user_sdma_alloc_queues()Markus Elfring
* Pass a product for a call of the function "vmalloc_user" without storing it in an intermediate variable. * Delete the local variable "memsize" which became unnecessary with this refactoring. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20IB/hfi1: Use kcalloc() in hfi1_user_sdma_alloc_queues()Markus Elfring
* Multiplications for the size determination of memory allocations indicated that array data structures should be processed. Thus reuse the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. * Replace the specification of a data type by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20IB/hfi1: Use kcalloc() in hfi1_user_exp_rcv_init()Markus Elfring
* A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus reuse the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. * Replace the specification of a data type by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20qede: allocate enough data for ->arfs_fltr_bmapDan Carpenter
We've got the number of longs, yes, but we should multiply by sizeof(long) to get the number of bytes needed. Fixes: e4917d46a653 ("qede: Add aRFS support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Yuval Mintz <Yuval.Mintz@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20MAINTAINERS: update entry for TI's CPSW driverSekhar Nori
Mugunthan V N, who was reviewing TI's CPSW driver patches is not working for TI anymore and wont be reviewing patches for that driver. Drop Mugunthan as the maintiainer for this driver. Grygorii continues to be a reviewer. Dave Miller applies the patches directly and adding a maintainer is actually misleading since get_maintainer.pl script stops suggesting that Dave Miller be copied. Signed-off-by: Sekhar Nori <nsekhar@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2017-04-19 Two fixes for af_key: 1) Add a lock to key dump to prevent a NULL pointer dereference. From Yuejie Shi. 2) Fix slab-out-of-bounds in parse_ipsecrequests. From Herbert Xu. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20tcp_cubic: fix typo in module param descriptionChema Gonzalez
Signed-off-by: Chema Gonzalez <chemag@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20Add Jiri Pirko as TC subsystem co-maintainerJamal Hadi Salim
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Acked-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20Add Cong Wang as TC subsystem co-maintainerJamal Hadi Salim
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20cxgb4: Convert PDBG to pr_debugJoe Perches
Use a more typical logging style. Miscellanea: o Obsolete the c4iw_debug module parameter o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20cxgb4: Use more common logging styleJoe Perches
Convert printks to pr_<level> Miscellanea: o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20cxgb3: Convert PDBG to pr_debugJoe Perches
Using the normal mechanism, not an indirected one, is clearer. Miscellanea: o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20cxgb3: Use more common logging styleJoe Perches
Convert printks to pr_<level> Miscellanea: o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Reviewed-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2017-04-20Merge branch '10GbE' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 10GbE Intel Wired LAN Driver Updates 2017-04-18 This series contains updates to mainly ixgbe with only one ixgbevf change. Usha adds a check to ensure the creation of number of VF's is valid based on the traffic classes configured, all to avoid transmit hangs. Joe Perches reduces the use of pr_cont since the output can be interleaved by other processes. Tony cleans up the code overwriting the KX4 config, which is configured by the NVM. Adds a check for MMNGC.MNG_VETO, to resolve an issue where we were getting a link loss for the BMC when loading the driver. Don fixes up SGMII x553 config details which were missed in earlier implementations. Added support for x552 XFI backplane interface support. Cleaned up an unused define, which was causing confusion on supported devices. Emil fixes a link issue on KR parts by making sure the default setting is set. Refactors the code so that the code for allocating memory for the list of MAC addresses that the VFs can use into its own function. Made some code cleans to help readability and ensure notification of SRIOV being enabled is done upon completion. Fixed an issue where if we failed to allocate vfinfo in __ixgbe_enable_sriov() the driver would crash with a NULL pointer dereference. Philippe Reynes updates ixgbevf to use the new API for {get|set}_link_ksettings. Alex increases the headroom allocation when using build_skb() on a system with 4K pages. Fixed an issue in ixgbe_dump() where we were no longer clearing the status bit. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20arm: Documentation: update a path namePerr Zhang
the path in the example cmd is out of date, and the path for now is also mentioned in the same file Signed-off-by: Perr Zhang <strongbox8@zoho.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2017-04-20dp83640: don't recieve time stamps twiceDan Carpenter
This patch is prompted by a static checker warning about a potential use after free. The concern is that netif_rx_ni() can free "skb" and we call it twice. When I look at the commit that added this, it looks like some stray lines were added accidentally. It doesn't make sense to me that we would recieve the same data two times. I asked the author but never recieved a response. I can't test this code, but I'm pretty sure my patch is correct. Fixes: 4b063258ab93 ("dp83640: Delay scheduled work.") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Stefan Sørensen <stefan.sorensen@spectralink.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20docs: process/4.Coding.rst: Fix a couple of document refsAndrew Clayton
In Documentation/process/4.Coding.rst there were a couple of paragraphs that spilled over the 80 character line length. This was likely caused when the document was converted to reStructuredText. Re-flow the paragraphs and make the document references proper reStructuredText :ref: links. This also adds the appropriate reStructuredText file heading to kernel-parameters.rst as referenced by the kernel-parameters link in this patch. Signed-off-by: Andrew Clayton <andrew@digital-domain.net> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2017-04-20net: ipv6: Fix UDP early demux lookup with udp_l3mdev_accept=0subashab@codeaurora.org
David Ahern reported that 5425077d73e0c ("net: ipv6: Add early demux handler for UDP unicast") breaks udp_l3mdev_accept=0 since early demux for IPv6 UDP was doing a generic socket lookup which does not require an exact match. Fix this by making UDPv6 early demux match connected sockets only. v1->v2: Take reference to socket after match as suggested by Eric v2->v3: Add comment before break Fixes: 5425077d73e0c ("net: ipv6: Add early demux handler for UDP unicast") Reported-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Cc: Eric Dumazet <edumazet@google.com> Acked-by: David Ahern <dsa@cumulusnetworks.com> Tested-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20Merge branch 'tcp_poll-flakes'David S. Miller
Eric Dumazet says: ==================== tcp: address two poll() flakes Some packetdrill tests are failing when host kernel is using ASAN or other debugging infrastructure. I was able to fix the flakes by making sure we were not sending wakeup events too soon. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20tcp: remove poll() flakes with FastOpenEric Dumazet
When using TCP FastOpen for an active session, we send one wakeup event from tcp_finish_connect(), right before the data eventually contained in the received SYNACK is queued to sk->sk_receive_queue. This means that depending on machine load or luck, poll() users might receive POLLOUT events instead of POLLIN|POLLOUT To fix this, we need to move the call to sk->sk_state_change() after the (optional) call to tcp_rcv_fastopen_synack() Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20tcp: remove poll() flakes when receiving RSTEric Dumazet
When a RST packet is processed, we send two wakeup events to interested polling users. First one by a sk->sk_error_report(sk) from tcp_reset(), followed by a sk->sk_state_change(sk) from tcp_done(). Depending on machine load and luck, poll() can either return POLLERR, or POLLIN|POLLOUT|POLLERR|POLLHUP (this happens on 99 % of the cases) This is probably fine, but we can avoid the confusion by reordering things so that we have more TCP fields updated before the first wakeup. This might even allow us to remove some barriers we added in the past. Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20ipv6: sr: fix out-of-bounds access in SRH validationDavid Lebrun
This patch fixes an out-of-bounds access in seg6_validate_srh() when the trailing data is less than sizeof(struct sr6_tlv). Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David Lebrun <david.lebrun@uclouvain.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20selftests/net: Fixes psock_fanout CBPF test caseMike Maloney
'psock_fanout' has been failing since commit 4d7b9dc1f36a9 ("tools: psock_lib: harden socket filter used by psock tests"). That commit changed the CBPF filter to examine the full ethernet frame, and was tested on 'psock_tpacket' which uses SOCK_RAW. But 'psock_fanout' was also using this same CBPF in two places, for filtering and fanout, on a SOCK_DGRAM socket. Change 'psock_fanout' to use SOCK_RAW so that the CBPF program used with SO_ATTACH_FILTER can examine the entire frame. Create a new CBPF program for use with PACKET_FANOUT_DATA which ignores the header, as it cannot see the ethernet header. Tested: Ran tools/testing/selftests/net/psock_{fanout,tpacket} 10 times, and they all passed. Fixes: 4d7b9dc1f36a9 ("tools: psock_lib: harden socket filter used by psock tests") Signed-off-by: 'Mike Maloney <maloneykernel@gmail.com>' Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20mac80211: reject ToDS broadcast data framesJohannes Berg
AP/AP_VLAN modes don't accept any real 802.11 multicast data frames, but since they do need to accept broadcast management frames the same is currently permitted for data frames. This opens a security problem because such frames would be decrypted with the GTK, and could even contain unicast L3 frames. Since the spec says that ToDS frames must always have the BSSID as the RA (addr1), reject any other data frames. The problem was originally reported in "Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys" at usenix https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/vanhoef and brought to my attention by Jouni. Cc: stable@vger.kernel.org Reported-by: Jouni Malinen <j@w1.fi> Signed-off-by: Johannes Berg <johannes.berg@intel.com> -- Dave, I didn't want to send you a new pull request for a single commit yet again - can you apply this one patch as is? Signed-off-by: David S. Miller <davem@davemloft.net>
2017-04-20Merge branch 'mlxsw-flow-based-forwarding-OVS'David S. Miller
Jiri Pirko says: ==================== mlxsw: Allow flow based forwarding in OVS This patchset does some fixes so the HW is setup correctly to do flow-based (ACL based) forwarding for OVS-enslaved port. The first patch is just trivial fix spotted on the way. Patches 2-4 take care of proper FID setup which HW needs in order to for ACL based forwarding. The 7th patch (with dependency of patch 5 and 6) takes care of proper setup of ports that are enslaved in OVS. The last patch implements new FID miss trap that is used to push packets belonging to unknown flows to kernel and userspace. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>