linux.git/net/bridge, branch v3.15-rc6

bridge: Handle IFLA_ADDRESS correctly when creating bridge device

2014-04-27T23:46:17+00:00

When bridge device is created with IFLA_ADDRESS, we are not calling
br_stp_change_bridge_id(), which leads to incorrect local fdb
management and bridge id calculation, and prevents us from receiving
frames on the bridge device.

Reported-by: Tom Gundersen 
Signed-off-by: Toshiaki Makita 
Signed-off-by: David S. Miller

bridge: Fix double free and memory leak around br_allowed_ingress

2014-04-11T19:12:47+00:00

br_allowed_ingress() has two problems.

1. If br_allowed_ingress() is called by br_handle_frame_finish() and
vlan_untag() in br_allowed_ingress() fails, skb will be freed by both
vlan_untag() and br_handle_frame_finish().

2. If br_allowed_ingress() is called by br_dev_xmit() and
br_allowed_ingress() fails, the skb will not be freed.

Fix these two problems by freeing the skb in br_allowed_ingress()
if it fails.

Signed-off-by: Toshiaki Makita 
Signed-off-by: David S. Miller

netfilter: Can't fail and free after table replacement

2014-04-05T15:46:22+00:00

All xtables variants suffer from the defect that the copy_to_user()
to copy the counters to user memory may fail after the table has
already been exchanged and thus exposed. Return an error at this
point will result in freeing the already exposed table. Any
subsequent packet processing will result in a kernel panic.

We can't copy the counters before exposing the new tables as we
want provide the counter state after the old table has been
unhooked. Therefore convert this into a silent error.

Cc: Florian Westphal 
Signed-off-by: Thomas Graf 
Signed-off-by: Pablo Neira Ayuso

bridge: use is_skb_forwardable in forward path

2014-03-31T20:04:04+00:00

Use existing function instead of trying to use our own.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-03-29T22:48:54+00:00

Conflicts:
	drivers/net/ethernet/marvell/mvneta.c

The mvneta.c conflict is a case of overlapping changes,
a conversion to devm_ioremap_resource() vs. a conversion
to netdev_alloc_pcpu_stats.

Signed-off-by: David S. Miller

netpoll: Remove gfp parameter from __netpoll_setup

2014-03-29T21:58:37+00:00

The gfp parameter was added in:
commit 47be03a28cc6c80e3aa2b3e8ed6d960ff0c5c0af
Author: Amerigo Wang 
Date:   Fri Aug 10 01:24:37 2012 +0000

    netpoll: use GFP_ATOMIC in slave_enable_netpoll() and __netpoll_setup()

    slave_enable_netpoll() and __netpoll_setup() may be called
    with read_lock() held, so should use GFP_ATOMIC to allocate
    memory. Eric suggested to pass gfp flags to __netpoll_setup().

    Cc: Eric Dumazet 
    Cc: "David S. Miller" 
    Reported-by: Dan Carpenter 
    Signed-off-by: Eric Dumazet 
    Signed-off-by: Cong Wang 
    Signed-off-by: David S. Miller 

The reason for the gfp parameter was removed in:
commit c4cdef9b7183159c23c7302aaf270d64c549f557
Author: dingtianhong 
Date:   Tue Jul 23 15:25:27 2013 +0800

    bonding: don't call slave_xxx_netpoll under spinlocks

    The slave_xxx_netpoll will call synchronize_rcu_bh(),
    so the function may schedule and sleep, it should't be
    called under spinlocks.

    bond_netpoll_setup() and bond_netpoll_cleanup() are always
    protected by rtnl lock, it is no need to take the read lock,
    as the slave list couldn't be changed outside rtnl lock.

    Signed-off-by: Ding Tianhong 
    Cc: Jay Vosburgh 
    Cc: Andy Gospodarek 
    Signed-off-by: David S. Miller 

Nothing else that calls __netpoll_setup or ndo_netpoll_setup
requires a gfp paramter, so remove the gfp parameter from both
of these functions making the code clearer.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

bridge: Fix crash with vlan filtering and tcpdump

2014-03-28T21:14:02+00:00

When the vlan filtering is enabled on the bridge, but
the filter is not configured on the bridge device itself,
running tcpdump on the bridge device will result in a
an Oops with NULL pointer dereference.  The reason
is that br_pass_frame_up() will bypass the vlan
check because promisc flag is set.  It will then try
to get the table pointer and process the packet based
on the table.  Since the table pointer is NULL, we oops.
Catch this special condition in br_handle_vlan().

Reported-by: Toshiaki Makita 
CC: Toshiaki Makita 
Signed-off-by: Vlad Yasevich 
Acked-by: Toshiaki Makita 
Signed-off-by: David S. Miller

bridge: Fix handling stacked vlan tags

2014-03-28T20:33:09+00:00

If a bridge with vlan_filtering enabled receives frames with stacked
vlan tags, i.e., they have two vlan tags, br_vlan_untag() strips not
only the outer tag but also the inner tag.

br_vlan_untag() is called only from br_handle_vlan(), and in this case,
it is enough to set skb->vlan_tci to 0 here, because vlan_tci has already
been set before calling br_handle_vlan().

Signed-off-by: Toshiaki Makita 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

bridge: Fix inabillity to retrieve vlan tags when tx offload is disabled

2014-03-28T20:33:09+00:00

Bridge vlan code (br_vlan_get_tag()) assumes that all frames have vlan_tci
if they are tagged, but if vlan tx offload is manually disabled on bridge
device and frames are sent from vlan device on the bridge device, the tags
are embedded in skb->data and they break this assumption.
Extract embedded vlan tags and move them to vlan_tci at ingress.

Signed-off-by: Toshiaki Makita 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

net/bridge: Use RCU_INIT_POINTER(x, NULL) in br_vlan.c

2014-03-27T04:18:09+00:00

This patch replaces rcu_assign_pointer(x, NULL) with RCU_INIT_POINTER(x, NULL)

The rcu_assign_pointer() ensures that the initialization of a structure
is carried out before storing a pointer to that structure.
And in the case of the NULL pointer, there is no structure to initialize.
So, rcu_assign_pointer(p, NULL) can be safely converted to RCU_INIT_POINTER(p, NULL)

Signed-off-by: Monam Agarwal 
Signed-off-by: David S. Miller