Re: [PATCH net] cls_u32: add missing RCU annotation.

t; rtnl lock, let use rtnl_dereference(). > > Fixes: a1b7c5fd7fe9 ("net: sched: add cls_u32 offload hooks for netdevs") > Fixes: de5df63228fc ("net: sched: cls_u32 changes to knode must appear atomic > to readers") > Signed-off-by: Paolo Abeni <pab...@redhat.com> Acked-by: Cong Wang <xiyou.wangc...@gmail.com>

Re: [PATCH net v2] cls_u32: fix use after free in u32_destroy_key()

On Fri, Feb 2, 2018 at 6:30 AM, Paolo Abeni wrote: > The problem is that the htnode is freed before the linked knodes and the > latter will try to access the first at u32_destroy_key() time. > This change addresses the issue using the htnode refcnt to guarantee > the correct

Re: iproute2 4.14.1 tc class add come to kernel-panic

t min_qdisc things, but it should be resolved by: >>> >>> >>>> commit efbf78973978b0d25af59bc26c8013a942af6e64 >>>> Author: Cong Wang <xiyou.wangc...@gmail.com> >>>> Date: Mon Dec 4 10:48:18 2017 -0800 >>> >>> >>>> net_sched:

Re: [Patch net] xt_RATEEST: acquire xt_rateest_mutex for hash insert

On Wed, Jan 31, 2018 at 5:44 PM, Eric Dumazet <eric.duma...@gmail.com> wrote: > On Wed, 2018-01-31 at 16:26 -0800, Cong Wang wrote: >> rateest_hash is supposed to be protected by xt_rateest_mutex. >> >> Reported-by: <syzbot+5cb189720978275e4...@syzkaller.appspotma

[Patch net] xt_RATEEST: acquire xt_rateest_mutex for hash insert

rateest_hash is supposed to be protected by xt_rateest_mutex. Reported-by: <syzbot+5cb189720978275e4...@syzkaller.appspotmail.com> Fixes: 5859034d7eb8 ("[NETFILTER]: x_tables: add RATEEST target") Cc: Pablo Neira Ayuso <pa...@netfilter.org> Signed-off-by: Cong Wang <

[Patch net] xt_cgroup: initialize info->priv in cgroup_mt_check_v1()

blo Neira Ayuso <pa...@netfilter.org> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/netfilter/xt_cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c index 1db1ce59079f..891f4e7e8ea7 100644 --- a/net/netfilter/xt_cgroup.c

Re: iproute2 4.14.1 tc class add come to kernel-panic

On Tue, Jan 30, 2018 at 9:46 AM, Roland Franke <fl...@franke-prem.de> wrote: > Hello, > >> Well, not min_qdisc things, but it should be resolved by: > > >> commit efbf78973978b0d25af59bc26c8013a942af6e64 >> Author: Cong Wang <xiyou.wangc...@gmail.com>

Re: net: hang in unregister_netdevice: waiting for lo to become free

On Tue, Jan 30, 2018 at 4:09 AM, Dmitry Vyukov wrote: > Hello, > > The following program creates a hang in unregister_netdevice. > cleanup_net work hangs there forever periodically printing > "unregister_netdevice: waiting for lo to become free. Usage count = 3" > and creation

Re: [Patch net-next v3 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

On Mon, Jan 29, 2018 at 9:43 AM, David Miller wrote: > > Please follow up with John about making the queue allocation use > a prepare + commit phase. Will do it once net-next is re-open. > > And as for the TX queue state handling on change, I think it's > fine to purge the

Re: iproute2 4.14.1 tc class add come to kernel-panic

On Mon, Jan 29, 2018 at 9:03 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: > On Mon, Jan 29, 2018 at 8:00 AM, Stephen Hemminger > <step...@networkplumber.org> wrote: >> On Mon, 29 Jan 2018 16:18:07 +0100 >> "Roland Franke" <fl...@franke-prem.de> wr

Re: iproute2 4.14.1 tc class add come to kernel-panic

On Mon, Jan 29, 2018 at 8:00 AM, Stephen Hemminger wrote: > On Mon, 29 Jan 2018 16:18:07 +0100 > "Roland Franke" wrote: > >> Hello, >> >> > To: Roland Franke ; netdev@vger.kernel.org >> > Subject: Re: BUG: iproute2 4.14.1 tc class add come to

Re: [Patch net-next v3 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

On Sun, Jan 28, 2018 at 10:09 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 01/28/2018 09:57 PM, Cong Wang wrote: >> On Sun, Jan 28, 2018 at 9:35 PM, John Fastabend >> <john.fastab...@gmail.com> wrote: >>> On 01/25/2018 06:26 PM, Cong Wan

Re: [Patch net-next v3 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

On Sun, Jan 28, 2018 at 9:35 PM, John Fastabend wrote: > We have time (its only in net-next) so lets do the complete fix > rather than this series IMO. Also have to remind you: this patchset fixes a regression introduced by your patchset in net-next, it is not a new

Re: [Patch net-next v3 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

On Sun, Jan 28, 2018 at 9:35 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 01/25/2018 06:26 PM, Cong Wang wrote: >> This pathcset restores the pfifo_fast qdisc behavior of dropping >> packets based on latest dev->tx_queue_len. Patch 1 introduces >> a he

Re: [PATCH net] net_sched: gen_estimator: fix lockdep splat

Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: syzbot <syzkal...@googlegroups.com> Acked-by: Cong Wang <xiyou.wangc...@gmail.com> Nit: perhaps it is better to move the spin_lock out of est_fetch_counters() and let callers decide to use spin_lock or spin_lock_bh.

Re: [PATCH net-next,v2 2/2] net: sched: add em_ipt ematch for calling xtables matches

On Fri, Jan 26, 2018 at 11:57 AM, Eyal Birger wrote: > On Fri, Jan 26, 2018 at 8:50 PM, Pablo Neira Ayuso > wrote: >> Isn't there a way to reject the use of this from ->change()? ie. from >> control plane configuration. > > I wasn't able to find a

Re: [Patch net-next v3 3/3] net_sched: implement ->change_tx_queue_len() for pfifo_fast

On Fri, Jan 26, 2018 at 6:10 AM, Michael S. Tsirkin wrote: > > This part? Yes, dev_deactivate() as you quote. > > + bool up = dev->flags & IFF_UP; > + unsigned int i; > + int ret = 0; > + > + if (up) > + dev_deactivate(dev); > + > +

Re: [Patch net-next v3 2/3] net_sched: plug in qdisc ops change_tx_queue_len

On Fri, Jan 26, 2018 at 6:16 AM, Michael S. Tsirkin wrote: > > This drops all packets in the queue. I don't think tweaking the queue > length did this previously - did it? No, because previously only enqueue reads the value. > If not this change might surprise some people. It

Re: 答复: [PATCH] net: clean the sk_frag.page of new cloned socket

On Thu, Jan 25, 2018 at 7:14 PM, Eric Dumazet wrote: > On Fri, 2018-01-26 at 02:09 +, Li,Rongqing wrote: > >> >> crash> bt 8683 >> PID: 8683 TASK: 881faa088000 CPU: 10 COMMAND: "mynode" >> #0 [881fff145e78] crash_nmi_callback at 81031712 >> #1

Re: [Patch net-next v3 3/3] net_sched: implement ->change_tx_queue_len() for pfifo_fast

On Thu, Jan 25, 2018 at 7:57 PM, Jason Wang <jasow...@redhat.com> wrote: > > > On 2018年01月26日 10:26, Cong Wang wrote: >> >> pfifo_fast used to drop based on qdisc_dev(qdisc)->tx_queue_len, >> so we have to resize skb array when we change tx_queue_len. >&g

[Patch net-next v3 2/3] net_sched: plug in qdisc ops change_tx_queue_len

handling race conditions with TX BH, we need to deactivate all TX queues before change the value and bring them back after we are done, this also makes implementation easier. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- include/n

[Patch net-next v3 1/3] net: introduce helper dev_change_tx_queue_len()

notifiers. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- include/linux/netdevice.h | 1 + net/core/dev.c| 28 net/core/net-sysfs.c | 25 + net/core/rtnetlink

[Patch net-next v3 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

ils. --- v3: use skb_array_resize_multiple() v2: handle error case for ->change_tx_queue_len() Cong Wang (3): net: introduce helper dev_change_tx_queue_len() net_sched: plug in qdisc ops change_tx_queue_len net_sched: implement ->change_tx_queue_len() for pfifo_fast include/linux/ne

[Patch net-next v3 3/3] net_sched: implement ->change_tx_queue_len() for pfifo_fast

nicer if they do so that users don't have to re-configure qdisc after changing tx_queue_len. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/sched/sch_generic.c | 18 ++ 1 file changed, 18 insertions(+) diff

Re: [Patch net-next v2 2/3] net_sched: plug in qdisc ops change_tx_queue_len

On Wed, Jan 24, 2018 at 4:05 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 01/23/2018 10:18 AM, Cong Wang wrote: >> +int dev_qdisc_change_tx_queue_len(struct net_device *dev) >> +{ >> + bool up = dev->flags & IFF_UP; >> +

[Patch net-next v2 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

ils. --- v2: handle error case for ->change_tx_queue_len() Cong Wang (3): net: introduce helper dev_change_tx_queue_len() net_sched: plug in qdisc ops change_tx_queue_len net_sched: implement ->change_tx_queue_len() for pfifo_fast include/linux/netdevice.h | 1 + include/net/sch_gener

[Patch net-next v2 1/3] net: introduce helper dev_change_tx_queue_len()

notifiers. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- include/linux/netdevice.h | 1 + net/core/dev.c| 28 net/core/net-sysfs.c | 25 + net/core/rtnetlink

[Patch net-next v2 2/3] net_sched: plug in qdisc ops change_tx_queue_len

handling race conditions with TX BH, we need to deactivate all TX queues before change the value and bring them back after we are done, this also makes implementation easier. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- include/n

[Patch net-next v2 3/3] net_sched: implement ->change_tx_queue_len() for pfifo_fast

nicer if they do so that users don't have to re-configure qdisc after changing tx_queue_len. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/sched/sch_generic.c | 17 + 1 file changed, 17 insertions(+) diff

Re: [Patch net-next 2/3] net_sched: plug in qdisc ops change_tx_queue_len

On Mon, Jan 22, 2018 at 2:44 PM, Cong Wang <xiyou.wangc...@gmail.com> wrote: > > Good point, but netdev_for_each_tx_queue() doesn't handle errors > in current code base, it is not trivial to make it returning int to reflect > errors, since we have to rollback a partial fai

Re: Network interface "stops working"

(Please always Cc netdev for networking related bugs.) On Mon, Jan 22, 2018 at 2:02 AM, Turbo Fredriksson wrote: > I just got a new broadband delivered at home. It is "Hyperoptic 1Gbps fiber" > which comes as a ethernet connector at home. I wasn’t around > when they connected

Re: [Patch net-next 2/3] net_sched: plug in qdisc ops change_tx_queue_len

On Sun, Jan 21, 2018 at 2:12 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 01/19/2018 03:09 PM, Cong Wang wrote: > > hmm what happens if the resize fails in the next patch, > >> >> +static void pfifo_fast_change_tx_queue_len(struct Qdisc

Re: [PATCH v2 net 2/2] net: sched: fix TCF_LAYER_LINK case in tcf_get_base_ptr

On Mon, Jan 22, 2018 at 2:53 AM, Wolfgang Bumiller wrote: > TCF_LAYER_LINK and TCF_LAYER_NETWORK returned the same pointer as > skb->data points to the network header. > Use skb_mac_header instead. skb->data points to network header only on ingress side, IIRC.

Re: [PATCH v2 net 0/2] nbyte, cmp and text filter fixups

m_text to actually match layer 0 rather than being the same > as specifying layer 1. > Acked-by: Cong Wang <xiyou.wangc...@gmail.com>

[Patch net-next] tun: avoid calling xdp_rxq_info_unreg() twice

bot+1c788d7ce0f0888f1...@syzkaller.appspotmail.com Fixes: 8565d26bcb2f ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net") Cc: Jason Wang <jasow...@redhat.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- drivers/net/tun.c | 2 -- 1 file changed, 2 deletions

Re: [PATCH net-next v3 0/2] net/sched: remove spinlock from 'csum' action

1% | 738190 ± 1% > drop | 2 |3212692 ± 2% | 3719811 ± 2% > drop | 4 |1078824 ± 1% |1328099 ± 1% Looks good to me, Acked-by: Cong Wang <xiyou.wangc...@gmail.com>

Re: WARNING in xdp_rxq_info_unreg

On Mon, Jan 22, 2018 at 11:58 AM, syzbot wrote: > Hello, > > syzbot hit the following crash on net-next commit > ebdd7b491b8a65d65936e07004caabca4a3c94a0 (Sun Jan 21 23:21:31 2018 +) > Merge branch

Re: [Patch net-next 1/3] net: introduce helper dev_change_tx_queue_len()

On Sat, Jan 20, 2018 at 8:52 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 01/19/2018 03:09 PM, Cong Wang wrote: >> This patch promotes the local change_tx_queue_len() to a core >> helper function, dev_change_tx_queue_len(), so that rtnetlink >> and net

Re: [PATCH net-next v2 2/2] net/sched: act_csum: don't use spinlock in the fast path

On Fri, Jan 19, 2018 at 6:12 AM, Davide Caratti wrote: > static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind, > @@ -575,15 +594,18 @@ static int tcf_csum_dump(struct sk_buff *skb, struct > tc_action *a, int bind, > { > unsigned char *b =

Re: net merged into net-next

On Fri, Jan 19, 2018 at 8:02 PM, David Miller wrote: > > Cong, please check my conflict resolution of drivers/net/tun.c, thank > you. It looks good to me except I am not sure about the xdp_rxq_info_unreg() inside tun_cleanup_tx_ring().

[Patch net-next 2/3] net_sched: plug in qdisc ops change_tx_queue_len

handling race conditions with TX BH, we need to deactivate all TX queues before change the value and bring them back after we are done, this also makes implementation easier. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- include/n

[Patch net-next 1/3] net: introduce helper dev_change_tx_queue_len()

notifiers. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- include/linux/netdevice.h | 1 + net/core/dev.c| 28 net/core/net-sysfs.c | 25 + net/core/rtnetlink

[Patch net-next 3/3] net_sched: implement ->change_tx_queue_len() for pfifo_fast

nicer if they do so that users don't have to re-configure qdisc after changing tx_queue_len. Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/sched/sch_generic.c | 13 + 1 file changed, 13 insertions(+) diff

[Patch net-next 0/3] net_sched: reflect tx_queue_len change for pfifo_fast

ils. --- Cong Wang (3): net: introduce helper dev_change_tx_queue_len() net_sched: plug in qdisc ops change_tx_queue_len net_sched: implement ->change_tx_queue_len() for pfifo_fast include/linux/netdevice.h | 1 + include/net/sch_generic.h | 2 ++ net/core/dev.c

Re: [patch net-next v10 02/13] net: sched: introduce shared filter blocks infrastructure

On Tue, Jan 16, 2018 at 7:33 AM, Jiri Pirko wrote: > static int __init tc_filter_init(void) > { > + int err; > + > tc_filter_wq = alloc_ordered_workqueue("tc_filter_workqueue", 0); > if (!tc_filter_wq) > return -ENOMEM; > > + err =

Re: [PATCH net-next 7/8] net: sched: cls: add extack support for tc_setup_cb_call

On Tue, Jan 16, 2018 at 9:20 AM, Alexander Aring wrote: > int tc_setup_cb_call(struct tcf_block *block, struct tcf_exts *exts, > -enum tc_setup_type type, void *type_data, bool err_stop) > +enum tc_setup_type type, void *type_data, bool

Re: [PATCH net-next 2/8] net: sched: cls_api: handle generic cls errors

On Tue, Jan 16, 2018 at 9:20 AM, Alexander Aring wrote: > @@ -1117,8 +1146,10 @@ int tcf_exts_validate(struct net *net, struct > tcf_proto *tp, struct nlattr **tb, > } > #else > if ((exts->action && tb[exts->action]) || > - (exts->police &&

Re: [PATCH net-next 8/8] net: sched: cls_u32: add extack support

On Tue, Jan 16, 2018 at 9:20 AM, Alexander Aring wrote: > - if (root_ht == ht) > + if (root_ht == ht) { > + NL_SET_ERR_MSG(extack, "Not allowd to delete root node"); s/allowd/allowed/

Re: KASAN: use-after-free Read in tipc_group_is_open

On Tue, Jan 16, 2018 at 5:23 AM, Jon Maloy <jon.ma...@ericsson.com> wrote: > > >> -Original Message----- >> From: Cong Wang [mailto:xiyou.wangc...@gmail.com] >> Sent: Monday, January 15, 2018 23:44 >> To: syzbot <syzbot+799dafde028679585...@syzkaller.a

Re: [Patch net v3] tun: fix a memory leak for tfile->tx_array

On Mon, Jan 15, 2018 at 10:37 PM, Jason Wang <jasow...@redhat.com> wrote: > > > On 2018年01月16日 14:33, Cong Wang wrote: >> But __tun_detach(true) is not a hot path, a memset() doesn't harm >> anything. > > > Yes, but it looks more more like a workaround or tri

Re: [PATCH net-next] net: sched: fix use before alloc of per cpu stats

On Mon, Jan 15, 2018 at 10:33 PM, Prashant Bhole wrote: > Pardon my ignorance, I think it is necessary to forward d59f5ffa59d8 to > -net. Because previously flags were set during init and checked after init > to allocate memory. static_flags makes the flags

Re: [Patch net v3] tun: fix a memory leak for tfile->tx_array

On Mon, Jan 15, 2018 at 10:12 PM, Jason Wang <jasow...@redhat.com> wrote: > > > On 2018年01月16日 14:07, Cong Wang wrote: >> >> On Mon, Jan 15, 2018 at 10:00 PM, Jason Wang <jasow...@redhat.com> wrote: >>> >>> I mean we can leave __tun_detach() as

Re: [PATCH net-next 2/2] net: sched: add xfrm policy ematch

On Fri, Jan 12, 2018 at 4:57 AM, Eyal Birger wrote: > +static void em_policy_destroy(struct tcf_ematch *em) > +{ > + const struct xt_policy_info *info = (const void *)em->data; > + > + if (!info) > + return; > + > + kfree((void *)em->data); >

Re: [Patch net v3] tun: fix a memory leak for tfile->tx_array

On Mon, Jan 15, 2018 at 10:00 PM, Jason Wang wrote: > I mean we can leave __tun_detach() as is, and just add the cleanup to > tun_detach_all(). This is because in both cases, we're sure skb array has > been initialized before. > Oh, I thought the same before sending v3, but

Re: [PATCH net-next] net: sched: fix use before alloc of per cpu stats

On Mon, Jan 15, 2018 at 9:47 PM, Prashant Bhole <bhole_prashant...@lab.ntt.co.jp> wrote: > > > On 1/16/2018 2:08 PM, Cong Wang wrote: >> >> On Sun, Jan 14, 2018 at 9:52 PM, Prashant Bhole >> <bhole_prashant...@lab.ntt.co.jp> wrote: >>> >>&g

Re: [Patch net v3] tun: fix a memory leak for tfile->tx_array

On Mon, Jan 15, 2018 at 9:46 PM, Jason Wang wrote: > > > I think then you don't even need the memset trick since we are sure it has > been implemented? It doesn't look like sk_alloc() zero's the memory of tfile.

Re: [PATCH net-next] net: sched: fix use before alloc of per cpu stats

On Sun, Jan 14, 2018 at 9:52 PM, Prashant Bhole wrote: > About bug: > During init of clsact/ingress, it links qdisc's cpu_bstats,cpu_qstats > with mini qdisc. TCQ_F_CPUSTATS is set in qdisc->flags during init and > this flag is checked after init to allocate

Re: KASAN: use-after-free Read in tipc_group_is_open

On Mon, Jan 15, 2018 at 7:58 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 594831a8aba3fd045c3212a3e3bb9788c77b989d > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1

[Patch net v3] tun: fix a memory leak for tfile->tx_array

array for tx") Cc: Jason Wang <jasow...@redhat.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- drivers/net/tun.c | 15 +-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 4f4a842a1c9c..a8ec589d1359 10

Re: [Patch net v2] tun: fix a memory leak for tfile->tx_array

On Sun, Jan 14, 2018 at 11:07 PM, Jason Wang <jasow...@redhat.com> wrote: > > > On 2018年01月14日 01:31, Cong Wang wrote: >> >> On Thu, Jan 11, 2018 at 2:16 AM, Jason Wang <jasow...@redhat.com> wrote: >>> >>> It looks to me what is actual miss

Re: [PATCH net] ipv6: Fix cleanup ordering on inet6_init() error path

en Hutchings <ben.hutchi...@codethink.co.uk> Acked-by: Cong Wang <xiyou.wangc...@gmail.com>

Re: [PATCH net] ipv6: Fix cleanup ordering on inet6_init() error path

On Thu, Jan 11, 2018 at 8:48 AM, Ben Hutchings <ben.hutchi...@codethink.co.uk> wrote: > On Wed, 2018-01-10 at 14:25 -0800, Cong Wang wrote: >> On Tue, Jan 9, 2018 at 10:21 AM, Ben Hutchings >> <ben.hutchi...@codethink.co.uk> wrote: >> > Commit 15e66

Re: [Patch net v2] tun: fix a memory leak for tfile->tx_array

On Thu, Jan 11, 2018 at 2:16 AM, Jason Wang wrote: > > It looks to me what is actual missed is the cleanups tun_detach_all(). For > me the only case that could leak is > > open > attach > ip link del link dev tap0 > close or another set_iff() > > So in this case, clean during

Re: sctp: memory leak in sctp_endpoint_init

On Tue, Jan 9, 2018 at 9:44 AM, 'Dmitry Vyukov' via syzkaller wrote: > Hello, > > syzkaller has hit the following memory leak on 4.15-rc7. > Reproducer is attached. > > unferenced object 0x88007bbaa720 (size 32): > comm "syz-executor4", pid 12479, jiffies

Re: [PATCH net] ipv6: Fix cleanup ordering on inet6_init() error path

On Tue, Jan 9, 2018 at 10:21 AM, Ben Hutchings wrote: > Commit 15e668070a64 reordered the initialisation in inet6_init() to > fix a crash on an error path further down the call stack. It also > reordered cleanup on the error path in inet6_init(), but the result >

[Patch net] tipc: fix a memory leak in tipc_nl_node_get_link()

gt; Cc: Ying Xue <ying@windriver.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/tipc/node.c | 26 ++ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/net/tipc/node.c b/net/tipc/node.c index 507017fe0f1b..9036d8756e73 100644 --

Re: KASAN: use-after-free Read in rb_first_postorder

On Tue, Jan 9, 2018 at 2:58 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 61ad64080e039dce99a7f8d89b729bbea995e2f7 > git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/master > compiler: gcc (GCC) 7.1.1

[Patch net v2] tun: fix a memory leak for tfile->tx_array

oesn't have such a check, so I check it in the caller, it is ugly but we can always improve it in net-next. Reported-by: Dmitry Vyukov <dvyu...@google.com> Fixes: 1576d9860599 ("tun: switch to use skb array for tx") Cc: Jason Wang <jasow...@redhat.com> Signed-off-by: Cong Wa

Re: [Patch net] tun: fix a memory leak for tfile->tx_array

On Tue, Jan 9, 2018 at 7:00 PM, Jason Wang <jasow...@redhat.com> wrote: > > > On 2018年01月10日 08:07, Cong Wang wrote: >> >> tfile->tun could be detached before we close the tun fd, >> via tun_detach_all(), so it should not be used to check for >>

[Patch net] tun: fix a memory leak for tfile->tx_array

n: switch to use skb array for tx") Cc: Jason Wang <jasow...@redhat.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- drivers/net/tun.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 4f4a842a1c9c..1a1f83

Re: [Patch net] 8021q: fix a memory leak for VLAN 0 device

On Tue, Jan 9, 2018 at 2:53 PM, Nikolay Aleksandrov <niko...@cumulusnetworks.com> wrote: > On 01/10/2018 12:47 AM, Cong Wang wrote: >> On Tue, Jan 9, 2018 at 2:30 PM, Nikolay Aleksandrov >> <niko...@cumulusnetworks.com> wrote: >>> >>> Just for re

Re: [Patch net] 8021q: fix a memory leak for VLAN 0 device

On Tue, Jan 9, 2018 at 2:30 PM, Nikolay Aleksandrov wrote: > > Just for reference - this is identical to the first part of: > https://patchwork.ozlabs.org/patch/252891/ > > I knew this looked familiar. :-) > Yeah, except bonding is not even involved. Unless I

[Patch net] 8021q: fix a memory leak for VLAN 0 device

n Hutchings <ben.hutchi...@codethink.co.uk> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/8021q/vlan.c | 7 +-- 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 8dfdd94e430f..bad01b14a4ad 100644 --- a/net/8021q/v

Re: KASAN: use-after-free Read in tipc_group_size

On Mon, Jan 8, 2018 at 6:58 AM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > b2cd1df66037e7c4697c7e40496bf7e4a5e16a2d > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1

Re: [PATCH net-next] net: sched: fix tcf_block_get_ext() in case CONFIG_NET_CLS is not set

On Thu, Jan 4, 2018 at 1:59 AM, Quentin Monnet <quentin.mon...@netronome.com> wrote: > Hi Cong, > > 2018-01-03 18:08 UTC-0800 ~ Cong Wang <xiyou.wangc...@gmail.com> >> On Wed, Jan 3, 2018 at 5:30 PM, Jakub Kicinski >> <jakub.kicin...@netronome.com> wrote

Re: [PATCH net-next] net: sched: fix tcf_block_get_ext() in case CONFIG_NET_CLS is not set

On Wed, Jan 3, 2018 at 5:30 PM, Jakub Kicinski wrote: > From: Quentin Monnet > > The definition of functions tcf_block_get() and tcf_block_get_ext() > depends of CONFIG_NET_CLS being set. When those functions gained extack > support,

Re: WARNING in sk_stream_kill_queues (2)

#syz dup: KASAN: slab-out-of-bounds Write in tcp_v6_syn_recv_sock

Re: "lockless" qdisc breaks tx_queue_len change too?

On Wed, Jan 3, 2018 at 10:09 AM, John Fastabend <john.fastab...@gmail.com> wrote: > On 01/02/2018 08:41 PM, Cong Wang wrote: >> Hi, John >> >> While reviewing your ptr_ring fix again today, it looks like your >> "lockless" qdisc patchset breaks de

Re: KASAN: slab-out-of-bounds Write in tcp_v6_syn_recv_sock

On Wed, Jan 3, 2018 at 12:55 PM, Ozgur <oz...@goosey.org> wrote: > > > 03.01.2018, 21:57, "Cong Wang" <xiyou.wangc...@gmail.com>: >> On Tue, Jan 2, 2018 at 3:58 PM, syzbot >> <syzbot+6dc95bddc6976b800...@syzkaller.appspotmail.com> wrote: >&

Re: KASAN: slab-out-of-bounds Write in tcp_v6_syn_recv_sock

On Tue, Jan 2, 2018 at 3:58 PM, syzbot wrote: > Hello, > > syzkaller hit the following crash on > 61233580f1f33c50e159c50e24d80ffd2ba2e06b > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1

"lockless" qdisc breaks tx_queue_len change too?

Hi, John While reviewing your ptr_ring fix again today, it looks like your "lockless" qdisc patchset breaks dev->tx_queue_len behavior. Before your patchset, dev->tx_queue_len is merely an integer to read, after your patchset, the skb array has to be resized when dev->tx_queue_len changes, but I

Re: [Patch net-next] net_sched: remove the unsafe __skb_array_empty()

On Sat, Dec 23, 2017 at 10:57 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 12/22/2017 12:31 PM, Cong Wang wrote: >> I understand why you had it, but it is just not safe. You don't want >> to achieve performance gain by crashing system, right? > > huh? S

Re: [Patch net-next] net_sched: call qdisc_reset() with qdisc lock

On Thu, Dec 21, 2017 at 7:36 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 12/21/2017 04:03 PM, Cong Wang wrote: >> qdisc_reset() should always be called with qdisc spinlock >> and with BH disabled, otherwise qdisc ->reset() could race >> with TX BH. >&

Re: [Patch net-next] net_sched: remove the unsafe __skb_array_empty()

On Thu, Dec 21, 2017 at 7:06 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 12/21/2017 04:03 PM, Cong Wang wrote: >> __skb_array_empty() is only safe if array is never resized. >> pfifo_fast_dequeue() is called in TX BH context and without >> qdisc lock,

[Patch net-next] net_sched: call qdisc_reset() with qdisc lock

tabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/sched/sch_generic.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 10aaa3b615ce..00ddb5f8f430 100644 --- a/net/sche

[Patch net-next] net_sched: remove the unsafe __skb_array_empty()

ted-by: Jakub Kicinski <jakub.kicin...@netronome.com> Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/sched/sch_generic.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c i

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 4:50 PM, Jakub Kicinski wrote: > On Wed, 20 Dec 2017 16:41:14 -0800, Jakub Kicinski wrote: >> Just as I hit send... :) but this looks unrelated, "Comm: sshd" - >> so probably from the management interface. >> >> [ 154.604041] >>

Re: [PATCH] net: Revert "net_sched: no need to free qdisc in RCU callback"

On Thu, Dec 21, 2017 at 12:39 AM, Jiri Pirko wrote: > > Why just moving qdisc_free to rcu is not enough? It would resolve this > issue and also avoid using synchronize net. Something like: If you mean Jakub's issue, apparently not:

Re: [Patch net] net_sched: fix a missing rcu barrier in mini_qdisc_pair_swap()

On Thu, Dec 21, 2017 at 11:01 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: > On Thu, Dec 21, 2017 at 1:03 AM, Jiri Pirko <j...@resnulli.us> wrote: >> >> >> But again, we don't we just free qdisc in call_rcu and avoid the >> barrier? > > > No

Re: RCU callback crashes

On Thu, Dec 21, 2017 at 8:26 AM, John Fastabend <john.fastab...@gmail.com> wrote: > On 12/20/2017 11:27 PM, Cong Wang wrote: >> On Wed, Dec 20, 2017 at 4:50 PM, Jakub Kicinski <kubak...@wp.pl> wrote: >>> On Wed, 20 Dec 2017 16:41:14 -0800, Jakub Kicinski

Re: [Patch net] net_sched: fix a missing rcu barrier in mini_qdisc_pair_swap()

sted-by: Jakub Kicinski <jakub.kicin...@netronome.com> >>Cc: Jiri Pirko <j...@mellanox.com> >>Cc: John Fastabend <john.fastab...@gmail.com> >>Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> >>--- >> net/sched/sch_generic.c | 4 +++- >> 1 f

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 4:50 PM, Jakub Kicinski wrote: > On Wed, 20 Dec 2017 16:41:14 -0800, Jakub Kicinski wrote: >> Just as I hit send... :) but this looks unrelated, "Comm: sshd" - >> so probably from the management interface. >> >> [ 154.604041] >>

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 4:37 PM, Jakub Kicinski <kubak...@wp.pl> wrote: > On Wed, 20 Dec 2017 16:03:49 -0800, Cong Wang wrote: >> On Wed, Dec 20, 2017 at 10:31 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: >> > On Wed, Dec 20, 2017 at 10:17 AM, Cong Wang <xiyo

[Patch net] net_sched: fix a missing rcu barrier in mini_qdisc_pair_swap()

<j...@mellanox.com> Cc: John Fastabend <john.fastab...@gmail.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- net/sched/sch_generic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index cd1

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 10:31 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: > On Wed, Dec 20, 2017 at 10:17 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: >> >> I guess it is q->miniqp which is freed in qdisc_graft() without properly >> waiting fo

Re: [PATCH] net: Revert "net_sched: no need to free qdisc in RCU callback"

On Wed, Dec 20, 2017 at 3:05 PM, John Fastabend <john.fastab...@gmail.com> wrote: > On 12/20/2017 02:41 PM, Cong Wang wrote: >> On Wed, Dec 20, 2017 at 12:09 PM, John Fastabend >> <john.fastab...@gmail.com> wrote: >>> RCU grace period is needed for

Re: [PATCH] net: Revert "net_sched: no need to free qdisc in RCU callback"

On Wed, Dec 20, 2017 at 12:09 PM, John Fastabend wrote: > RCU grace period is needed for lockless qdiscs added in the commit > c5ad119fb6c09 ("net: sched: pfifo_fast use skb_array"). > > It is needed now that qdiscs may be lockless otherwise we risk > free'ing a qdisc

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 12:23 PM, John Fastabend wrote: > I'm trying to see how removing that rcu grace period was safe in the > first place. The datapath is using rcu_read critical section to protect > the qdisc but the control path (a) doesn't use rcu grace period and

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 12:14 PM, John Fastabend wrote: > > Hi, > > Just sent a patch to complete qdisc_destroy from rcu callback. This > is needed to resolve a race with the lockless qdisc patches. > > But I guess it should fix the miniq issue as well? If you ever

Re: RCU callback crashes

On Wed, Dec 20, 2017 at 10:17 AM, Cong Wang <xiyou.wangc...@gmail.com> wrote: > > I guess it is q->miniqp which is freed in qdisc_graft() without properly > waiting for rcu readers? It is probably so, the call_rcu_bh(_old->rcu, mini_qdisc_rcu_func) in the end of mini_qdisc_p

<    1   2   3   4   5   6   7   8   9   10   >