linux.git/net/ipv4/icmp.c, branch v4.3

net: Fix panic in icmp_route_lookup

2015-09-26T04:44:02+00:00

Andrey reported a panic:

[ 7249.865507] BUG: unable to handle kernel pointer dereference at 000000b4
[ 7249.865559] IP: [] icmp_route_lookup+0xaa/0x320
[ 7249.865598] *pdpt = 0000000030f7f001 *pde = 0000000000000000
[ 7249.865637] Oops: 0000 [#1]
...
[ 7249.866811] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
4.3.0-999-generic #201509220155
[ 7249.866876] Hardware name: MSI MS-7250/MS-7250, BIOS 080014  08/02/2006
[ 7249.866916] task: c1a5ab00 ti: c1a52000 task.ti: c1a52000
[ 7249.866949] EIP: 0060:[] EFLAGS: 00210246 CPU: 0
[ 7249.866981] EIP is at icmp_route_lookup+0xaa/0x320
[ 7249.867012] EAX: 00000000 EBX: f483ba48 ECX: 00000000 EDX: f2e18a00
[ 7249.867045] ESI: 000000c0 EDI: f483ba70 EBP: f483b9ec ESP: f483b974
[ 7249.867077]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 7249.867108] CR0: 8005003b CR2: 000000b4 CR3: 36ee07c0 CR4: 000006f0
[ 7249.867141] Stack:
[ 7249.867165]  320310ee 00000000 00000042 320310ee 00000000 c1aeca00
f3920240 f0c69180
[ 7249.867268]  f483ba04 f855058b a89b66cd f483ba44 f8962f4b 00000000
e659266c f483ba54
[ 7249.867361]  8004753c f483ba5c f8962f4b f2031140 000003c1 ffbd8fa0
c16b0e00 00000064
[ 7249.867448] Call Trace:
[ 7249.867494]  [] ? e1000_xmit_frame+0x87b/0xdc0 [e1000e]
[ 7249.867534]  [] ? tcp_in_window+0xeb/0xb10 [nf_conntrack]
[ 7249.867576]  [] ? tcp_in_window+0xeb/0xb10 [nf_conntrack]
[ 7249.867615]  [] ? icmp_send+0xa0/0x380
[ 7249.867648]  [] icmp_send+0x2cf/0x380
[ 7249.867681]  [] nf_send_unreach+0xa6/0xc0 [nf_reject_ipv4]
[ 7249.867714]  [] reject_tg+0x7a/0x9f [ipt_REJECT]
[ 7249.867746]  [] ipt_do_table+0x317/0x70c [ip_tables]
[ 7249.867780]  [] ? __nf_conntrack_find_get+0x166/0x3b0
[nf_conntrack]
[ 7249.867838]  [] ? nf_conntrack_in+0x398/0x600 [nf_conntrack]
[ 7249.867889]  [] iptable_filter_hook+0x35/0x80 [iptable_filter]
[ 7249.867933]  [] nf_iterate+0x71/0x80
[ 7249.867970]  [] nf_hook_slow+0x65/0xc0
[ 7249.868002]  [] __ip_local_out_sk+0xc1/0xd0
[ 7249.868034]  [] ? ip_forward_options+0x1a0/0x1a0
[ 7249.868066]  [] ip_local_out_sk+0x16/0x30
[ 7249.868097]  [] ip_send_skb+0x14/0x80
[ 7249.868129]  [] ip_push_pending_frames+0x34/0x40
[ 7249.868163]  [] ip_send_unicast_reply+0x282/0x310
[ 7249.868196]  [] tcp_v4_send_reset+0x1b3/0x380
[ 7249.868227]  [] tcp_v4_rcv+0x323/0x990
[ 7249.868257]  [] ? nf_iterate+0x71/0x80
[ 7249.868289]  [] ip_local_deliver_finish+0x8b/0x230
[ 7249.868322]  [] ip_local_deliver+0x4c/0xa0
[ 7249.868353]  [] ? ip_rcv_finish+0x390/0x390
[ 7249.868384]  [] ip_rcv_finish+0x7c/0x390
[ 7249.868415]  [] ip_rcv+0x2e0/0x420
...

Prior to the VRF change the oif was not set in the flow struct, so the
VRF support should really have only added the vrf_master_ifindex lookup.

Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX")
Cc: Andrey Melnikov 
Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

net: Add support for VRFs to inetpeer cache

2015-08-28T20:32:36+00:00

inetpeer caches based on address only, so duplicate IP addresses within
a namespace return the same cached entry. Enhance the ipv4 address key
to contain both the IPv4 address and VRF device index.

Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

vrf: vrf_master_ifindex_rcu is not always called with rcu read lock

2015-08-20T05:13:20+00:00

While running net-next I hit this:
[  634.073119] ===============================
[  634.073150] [ INFO: suspicious RCU usage. ]
[  634.073182] 4.2.0-rc6+ #45 Not tainted
[  634.073213] -------------------------------
[  634.073244] include/net/vrf.h:38 suspicious rcu_dereference_check()
usage!
[  634.073274]
               other info that might help us debug this:

[  634.073307]
               rcu_scheduler_active = 1, debug_locks = 1
[  634.073338] 2 locks held by swapper/0/0:
[  634.073369]  #0:  (((&n->timer))){+.-...}, at: []
call_timer_fn+0x5/0x480
[  634.073412]  #1:  (slock-AF_INET){+.-...}, at: []
icmp_send+0x155/0x5f0
[  634.073450]
               stack backtrace:
[  634.073483] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.2.0-rc6+ #45
[  634.073514] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
VirtualBox 12/01/2006
[  634.073545]  0000000000000000 0593ba8242d9ace4 ffff88002fc03b48
ffffffff81803f1b
[  634.073612]  0000000000000000 ffffffff81e12500 ffff88002fc03b78
ffffffff811003c5
[  634.073642]  0000000000000000 ffff88002ec4e600 ffffffff81f00f80
ffff88002fc03cf0
[  634.073669] Call Trace:
[  634.073694]    [] dump_stack+0x4c/0x65
[  634.073728]  [] lockdep_rcu_suspicious+0xc5/0x100
[  634.073763]  [] icmp_route_lookup+0x176/0x5c0
[  634.073793]  [] ? icmp_send+0x35b/0x5f0
[  634.073818]  [] ? icmp_send+0x2d4/0x5f0
[  634.073844]  [] icmp_send+0x42e/0x5f0
[  634.073873]  [] ipv4_link_failure+0x22/0xa0
[  634.073899]  [] arp_error_report+0x3a/0x80
[  634.073926]  [] ? neigh_lookup+0x2c0/0x2c0
[  634.073952]  [] neigh_invalidate+0x8e/0x110
[  634.073984]  [] neigh_timer_handler+0x1ae/0x290
[  634.074013]  [] ? neigh_lookup+0x2c0/0x2c0
[  634.074013]  [] call_timer_fn+0xb3/0x480
[  634.074013]  [] ? call_timer_fn+0x5/0x480
[  634.074013]  [] ? neigh_lookup+0x2c0/0x2c0
[  634.074013]  [] run_timer_softirq+0x20c/0x430
[  634.074013]  [] __do_softirq+0xde/0x630
[  634.074013]  [] irq_exit+0x117/0x120
[  634.074013]  [] smp_apic_timer_interrupt+0x46/0x60
[  634.074013]  [] apic_timer_interrupt+0x70/0x80
[  634.074013]    [] ? native_safe_halt+0x6/0x10
[  634.074013]  [] ? trace_hardirqs_on+0xd/0x10
[  634.074013]  [] default_idle+0x23/0x200
[  634.074013]  [] arch_cpu_idle+0xf/0x20
[  634.074013]  [] default_idle_call+0x2a/0x40
[  634.074013]  [] cpu_startup_entry+0x39c/0x4c0
[  634.074013]  [] rest_init+0x13d/0x150
[  634.074013]  [] start_kernel+0x4a8/0x4c9
[  634.074013]  [] ?
early_idt_handler_array+0x120/0x120
[  634.074013]  [] x86_64_start_reservations+0x2a/0x2c
[  634.074013]  [] x86_64_start_kernel+0x14a/0x16d

It would seem vrf_master_ifindex_rcu() can be called without RCU held in
other contexts as well so introduce a new helper which acquires rcu and
returns the ifindex.
Also add curly braces around both the "if" and "else" parts as per the
style guide.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

net: Fix up inet_addr_type checks

2015-08-14T05:43:21+00:00

Currently inet_addr_type and inet_dev_addr_type expect local addresses
to be in the local table. With the VRF device local routes for devices
associated with a VRF will be in the table associated with the VRF.
Provide an alternate inet_addr lookup to use a specific table rather
than defaulting to the local table.

inet_addr_type_dev_table keeps the same semantics as inet_addr_type but
if the passed in device is enslaved to a VRF then the table for that VRF
is used for the lookup.

Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

net: Use VRF device index for lookups on TX

2015-08-14T05:43:20+00:00

As with ingress use the index of VRF master device for route lookups on
egress. However, the oif should only be used to direct the lookups to a
specific table. Routes in the table are not based on the VRF device but
rather interfaces that are part of the VRF so do not consider the oif for
lookups within the table. The FLOWI_FLAG_VRFSRC is used to control this
latter part.

Signed-off-by: Shrijeet Mukherjee 
Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

icmp: Don't leak original dst into ip_route_input()

2015-07-21T17:39:05+00:00

ip_route_input() unconditionally overwrites the dst. Hide the original
dst attached to the skb by calling skb_dst_set(skb, NULL) prior to
ip_route_input().

Reported-by: Julian Anastasov 
Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

ipv4: coding style: comparison for equality with NULL

2015-04-03T16:11:15+00:00

The ipv4 code uses a mixture of coding styles. In some instances check
for NULL pointer is done as x == NULL and sometimes as !x. !x is
preferred according to checkpatch and this patch makes the code
consistent by adopting the latter form.

No changes detected by objdiff.

Signed-off-by: Ian Morris 
Signed-off-by: David S. Miller

ipv4: icmp: use percpu allocation

2015-02-01T01:48:18+00:00

Get rid of nr_cpu_ids and use modern percpu allocation.

Note that the sockets themselves are not yet allocated
using NUMA affinity.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

icmp: Remove some spurious dropped packet profile hits from the ICMP path

2014-11-18T20:28:28+00:00

If icmp_rcv() has successfully processed the incoming ICMP datagram, we
should use consume_skb() rather than kfree_skb() because a hit on the likes
of perf -e skb:kfree_skb is not called-for.

Signed-off-by: Rick Jones 
Signed-off-by: David S. Miller

net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited

2014-11-11T19:10:31+00:00

Use the more common dynamic_debug capable net_dbg_ratelimited
and remove the LIMIT_NETDEBUG macro.

All messages are still ratelimited.

Some KERN_ uses are changed to KERN_DEBUG.

This may have some negative impact on messages that were
emitted at KERN_INFO that are not not enabled at all unless
DEBUG is defined or dynamic_debug is enabled.  Even so,
these messages are now _not_ emitted by default.

This also eliminates the use of the net_msg_warn sysctl
"/proc/sys/net/core/warnings".  For backward compatibility,
the sysctl is not removed, but it has no function.  The extern
declaration of net_msg_warn is removed from sock.h and made
static in net/core/sysctl_net_core.c

Miscellanea:

o Update the sysctl documentation
o Remove the embedded uses of pr_fmt
o Coalesce format fragments
o Realign arguments

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller